Edit tour

Windows Analysis Report
gem1.exe

Overview

General Information

Sample name:	gem1.exe
Analysis ID:	1587387
MD5:	d61ac037c333f1bc288c1a96a4db7c21
SHA1:	777228616a18b98103594276775188b5e138fa11
SHA256:	f5946e9f0ab4dbbd8d8171e708607c98df283cb1a6145444ba6a5f86bb2b0896
Tags:	exeJalapenomalwaretrojanuser-Joker
Infos:

Detection

CredGrabber, Meduza Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected CredGrabber

Yara detected Meduza Stealer

AI detected suspicious sample

Contains functionality to inject code into remote processes

Found many strings related to Crypto-Wallets (likely being stolen)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found evasive API chain checking for process token information

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Terminates after testing mutex exists (may check infected machine status)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

gem1.exe (PID: 7424 cmdline: "C:\Users\user\Desktop\gem1.exe" MD5: D61AC037C333F1BC288C1A96A4DB7C21)

conhost.exe (PID: 7432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

gem1.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\gem1.exe" MD5: D61AC037C333F1BC288C1A96A4DB7C21)

WerFault.exe (PID: 7588 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 920 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Configuration

Threatname: Meduza Stealer

{"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "1", "links": "", "port": 15666}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
Process Memory Space: gem1.exe PID: 7488	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
Process Memory Space: gem1.exe PID: 7488	JoeSecurity_CredGrabber	Yara detected CredGrabber	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.gem1.exe.39def70.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.gem1.exe.39def70.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
2.2.gem1.exe.400000.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.gem1.exe.39def70.0.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
2.2.gem1.exe.400000.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfd6dc:$str01: emoji 0xffed8:$str02: %d-%m-%Y, %H:%M:%S 0xfff40:$str03: [UTC 0xfff4c:$str04: user_name 0xfff70:$str05: computer_name 0xfff94:$str06: timezone 0xffec4:$str07: current_path() 0xfd6a8:$str08: [json.exception. 0x11362e:$str09: GDI32.dll 0x1138a0:$str10: GdipGetImageEncoders 0x113918:$str10: GdipGetImageEncoders 0x112f48:$str11: GetGeoInfoA
0.2.gem1.exe.39def70.0.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xfbcdc:$str01: emoji 0xfe4d8:$str02: %d-%m-%Y, %H:%M:%S 0xfe540:$str03: [UTC 0xfe54c:$str04: user_name 0xfe570:$str05: computer_name 0xfe594:$str06: timezone 0xfe4c4:$str07: current_path() 0xfbca8:$str08: [json.exception. 0x111c2e:$str09: GDI32.dll 0x111ea0:$str10: GdipGetImageEncoders 0x111f18:$str10: GdipGetImageEncoders 0x111548:$str11: GetGeoInfoA
2.2.gem1.exe.400000.0.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
2.2.gem1.exe.400000.0.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0xff0dc:$str01: emoji 0x1018d8:$str02: %d-%m-%Y, %H:%M:%S 0x101940:$str03: [UTC 0x10194c:$str04: user_name 0x101970:$str05: computer_name 0x101994:$str06: timezone 0x1018c4:$str07: current_path() 0xff0a8:$str08: [json.exception. 0x11502e:$str09: GDI32.dll 0x1152a0:$str10: GdipGetImageEncoders 0x115318:$str10: GdipGetImageEncoders 0x114948:$str11: GetGeoInfoA
0.2.gem1.exe.38b9550.1.raw.unpack	JoeSecurity_MeduzaStealer	Yara detected Meduza Stealer	Joe Security
0.2.gem1.exe.38b9550.1.raw.unpack	infostealer_win_meduzastealer	Finds MeduzaStealer samples based on specific strings	Sekoia.io	0x2230fc:$str01: emoji 0x2258f8:$str02: %d-%m-%Y, %H:%M:%S 0x225960:$str03: [UTC 0x22596c:$str04: user_name 0x225990:$str05: computer_name 0x2259b4:$str06: timezone 0x2258e4:$str07: current_path() 0x2230c8:$str08: [json.exception. 0x23904e:$str09: GDI32.dll 0x2392c0:$str10: GdipGetImageEncoders 0x239338:$str10: GdipGetImageEncoders 0x238968:$str11: GetGeoInfoA
Click to see the 5 entries

Suricata Signatures

ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:14:02.588084+0100	2049441	1	A Network Trojan was detected	192.168.2.4	49730	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:14:02.588084+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	66.63.187.173	15666	TCP
2025-01-10T10:14:02.593447+0100	2050806	1	A Network Trojan was detected	192.168.2.4	49730	66.63.187.173	15666	TCP

ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T10:14:02.588084+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	66.63.187.173	15666	TCP
2025-01-10T10:14:02.593447+0100	2050807	1	A Network Trojan was detected	192.168.2.4	49730	66.63.187.173	15666	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: gem1.exe

Avira: detected

Found malware configuration

Source: 0.2.gem1.exe.39def70.0.raw.unpack

Malware Configuration Extractor: Meduza Stealer {"C2 url": "66.63.187.173", "grabber_max_size": 4194304, "anti_vm": true, "anti_dbg": true, "self_destruct": false, "extensions": ".txt; .doc; .xlsx", "build_name": "1", "links": "", "port": 15666}

Multi AV Scanner detection for submitted file

Source: gem1.exe	Virustotal: Detection: 43%			Perma Link
Source: gem1.exe	ReversingLabs: Detection: 44%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for sample

Source: gem1.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0047A610 CryptUnprotectData,LocalFree,	2_2_0047A610
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043D4A0 BCryptDestroyKey,	2_2_0043D4A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0047A950 CryptProtectData,LocalFree,	2_2_0047A950
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0047AAE0 BCryptDecrypt,BCryptDecrypt,	2_2_0047AAE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00440B60 CryptUnprotectData,LocalFree,	2_2_00440B60
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0047AE10 BCryptCloseAlgorithmProvider,	2_2_0047AE10
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0047AE80 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,	2_2_0047AE80

Source: gem1.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: gem1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: System.Windows.Forms.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb4 source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: Handler.pdb source: gem1.exe, WERD8C3.tmp.dmp.5.dr
Source:	Binary string: Handler.pdbha~a pa_CorExeMainmscoree.dll source: gem1.exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: Handler.pdbMZ@ source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb( source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERD8C3.tmp.dmp.5.dr

Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004402D0 FindFirstFileW,FindNextFileW,	2_2_004402D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	2_2_004B84C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004B8545
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B84E0 FindFirstFileExW,	2_2_004B84E0

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00487550 GetLogicalDriveStringsW,

2_2_00487550

Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049441 - Severity 1 - ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt : 192.168.2.4:49730 -> 66.63.187.173:15666
Source: Network traffic	Suricata IDS: 2050806 - Severity 1 - ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2 : 192.168.2.4:49730 -> 66.63.187.173:15666

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 66.63.187.173:15666

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205
Source: Joe Sandbox View	IP Address: 104.26.12.205 104.26.12.205

Source: Joe Sandbox View

ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: Network traffic

Suricata IDS: 2050807 - Severity 1 - ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP) : 192.168.2.4:49730 -> 66.63.187.173:15666

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.173

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00485350 recv,recv,recv,recv,recv,recv,closesocket,WSACleanup,

2_2_00485350

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html; text/plain; */*Host: api.ipify.orgCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: api.ipify.org

Source: Amcache.hve.5.dr	String found in binary or memory: http://upx.sf.net
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/~

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443

Source: unknown

HTTPS traffic detected: 104.26.12.205:443 -> 192.168.2.4:49731 version: TLS 1.2

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00485F00 GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SHCreateMemStream,SelectObject,DeleteDC,ReleaseDC,DeleteObject,IStream_Size,IStream_Reset,IStream_Read,SelectObject,DeleteDC,ReleaseDC,DeleteObject,

2_2_00485F00

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.gem1.exe.39def70.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 2.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.gem1.exe.39def70.0.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 2.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 0.2.gem1.exe.38b9550.1.raw.unpack, type: UNPACKEDPE	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io
Source: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Finds MeduzaStealer samples based on specific strings Author: Sekoia.io

Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0048A0A0 GetModuleHandleA,GetProcAddress,OpenProcess,NtQuerySystemInformation,NtQuerySystemInformation,NtQuerySystemInformation,GetCurrentProcess,NtQueryObject,GetFinalPathNameByHandleA,CloseHandle,CloseHandle,		2_2_0048A0A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,		2_2_0048A710

Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004422D0	2_2_004422D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043A2B0	2_2_0043A2B0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00446400	2_2_00446400
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00488400	2_2_00488400
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043E4F0	2_2_0043E4F0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004395D0	2_2_004395D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00487780	2_2_00487780
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00485840	2_2_00485840
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043C970	2_2_0043C970
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004479C0	2_2_004479C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00459A06	2_2_00459A06
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0046EB70	2_2_0046EB70
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0046BCE0	2_2_0046BCE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00439D60	2_2_00439D60
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00470EF0	2_2_00470EF0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043BF70	2_2_0043BF70
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00462080	2_2_00462080
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004320A0	2_2_004320A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004A70A7	2_2_004A70A7
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0042D150	2_2_0042D150
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00479130	2_2_00479130
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00474190	2_2_00474190
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00461250	2_2_00461250
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00408270	2_2_00408270
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B6380	2_2_004B6380
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00407470	2_2_00407470
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00462410	2_2_00462410
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0045C4C0	2_2_0045C4C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043D4A0	2_2_0043D4A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0047E580	2_2_0047E580
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0046B620	2_2_0046B620
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00468750	2_2_00468750
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00419770	2_2_00419770
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0045C700	2_2_0045C700
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004917CA	2_2_004917CA
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0045D7A0	2_2_0045D7A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004627A0	2_2_004627A0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0049687E	2_2_0049687E
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B6870	2_2_004B6870
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043A800	2_2_0043A800
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00493800	2_2_00493800
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0049F8A2	2_2_0049F8A2
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00461940	2_2_00461940
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00445950	2_2_00445950
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00478990	2_2_00478990
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004ACA4B	2_2_004ACA4B
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00406AE0	2_2_00406AE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B3AE0	2_2_004B3AE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00430AF0	2_2_00430AF0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0048AA80	2_2_0048AA80
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00414AA0	2_2_00414AA0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0045EAA0	2_2_0045EAA0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00476AB6	2_2_00476AB6
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00462B50	2_2_00462B50
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00482C4B	2_2_00482C4B
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004BCC40	2_2_004BCC40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00461CC0	2_2_00461CC0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00478D40	2_2_00478D40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B6D30	2_2_004B6D30
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B1D30	2_2_004B1D30
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00440DE0	2_2_00440DE0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0043AE50	2_2_0043AE50
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_0042EEA0	2_2_0042EEA0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00406F40	2_2_00406F40
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00444F50	2_2_00444F50
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00443F00	2_2_00443F00
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00456F00	2_2_00456F00
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00412FA0	2_2_00412FA0

Source: C:\Users\user\Desktop\gem1.exe	Code function: String function: 004AC500 appears 58 times
Source: C:\Users\user\Desktop\gem1.exe	Code function: String function: 004517F0 appears 53 times

Source: C:\Users\user\Desktop\gem1.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 920

Source: gem1.exe, 00000000.00000002.1846479305.00000000038B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamerasdlui.exej% vs gem1.exe
Source: gem1.exe, 00000000.00000000.1683275182.0000000000478000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerasdlui.exej% vs gem1.exe
Source: gem1.exe, 00000000.00000002.1842881543.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs gem1.exe
Source: gem1.exe	Binary or memory string: OriginalFilenamerasdlui.exej% vs gem1.exe

Source: gem1.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.gem1.exe.39def70.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 2.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.gem1.exe.39def70.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 2.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 0.2.gem1.exe.38b9550.1.raw.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1
Source: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: infostealer_win_meduzastealer author = Sekoia.io, description = Finds MeduzaStealer samples based on specific strings, creation_date = 2023-06-20, classification = TLP:CLEAR, version = 1.0, id = 1276f485-aa5d-491b-89d8-77f98dc496e1

Source: gem1.exe

Static PE information: Section: .bss ZLIB complexity 1.0003138195647467

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/5@1/2

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_0048CB50 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,

2_2_0048CB50

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_004473D0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_004473D0

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00477EE0 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,CoSetProxyBlanket,SysAllocStringByteLen,SysFreeString,SysAllocStringByteLen,SysFreeString,SysStringByteLen,SysStringByteLen,SysFreeString,SysFreeString,

2_2_00477EE0

Source: C:\Users\user\Desktop\gem1.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mmm-A33C734061CA11EE8C18806E6F6E69637EB967C5
Source: C:\Users\user\Desktop\gem1.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7432:120:WilError_03
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7424

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\8575bffc-36a2-4b94-adbd-5e5163c8fa9e

Jump to behavior

Source: gem1.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: gem1.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gem1.exe	Virustotal: Detection: 43%
Source: gem1.exe	ReversingLabs: Detection: 44%

Source: C:\Users\user\Desktop\gem1.exe

File read: C:\Users\user\Desktop\gem1.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 920
Source: C:\Users\user\Desktop\gem1.exe	Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: gem1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: gem1.exe

Static file information: File size 1202688 > 1048576

Source: gem1.exe

Static PE information: Raw size of .bss is bigger than: 0x100000 < 0x120a00

Source: gem1.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: gem1.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: System.Windows.Forms.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdbRSDS source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.Windows.Forms.pdb4 source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: mscorlib.ni.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: Handler.pdb source: gem1.exe, WERD8C3.tmp.dmp.5.dr
Source:	Binary string: Handler.pdbha~a pa_CorExeMainmscoree.dll source: gem1.exe
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: Handler.pdbMZ@ source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: mscorlib.pdb( source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.ni.pdb source: WERD8C3.tmp.dmp.5.dr
Source:	Binary string: System.pdb source: WERD8C3.tmp.dmp.5.dr

Source: gem1.exe

Static PE information: 0xD2E802CF [Sun Feb 15 22:33:51 2082 UTC]

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_00446400

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_004ACE0C push ecx; ret

2_2_004ACE1F

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_0047E240 GetCurrentProcess,OpenProcessToken,GetTokenInformation,CloseHandle,ExitProcess,OpenMutexA,ExitProcess,CreateMutexA,ExitProcess,ReleaseMutex,CloseHandle,

2_2_0047E240

Source: C:\Users\user\Desktop\gem1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Memory allocated: 1090000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Memory allocated: 28B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Memory allocated: 48B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_2-49111

Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004402D0 FindFirstFileW,FindNextFileW,	2_2_004402D0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B84C0 FindClose,FindFirstFileExW,GetLastError,	2_2_004B84C0
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B8545 GetFileAttributesExW,GetLastError,FindFirstFileW,GetLastError,FindClose,___std_fs_open_handle@16,GetFileInformationByHandleEx,GetLastError,GetFileInformationByHandleEx,GetFileInformationByHandleEx,	2_2_004B8545
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004B84E0 FindFirstFileExW,	2_2_004B84E0

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00487550 GetLogicalDriveStringsW,

2_2_00487550

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00498574 VirtualQuery,GetSystemInfo,VirtualAlloc,VirtualProtect,

2_2_00498574

Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\migration\wtr\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-activedirectory-webservices\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\microsoft-client-license-platform-service-migration\	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: D:\sources\replacementmanifests\hwvid-migration-2\	Jump to behavior

Source: Amcache.hve.5.dr	Binary or memory string: VMware
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.5.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.5.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.5.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: gem1.exe, 00000002.00000002.1863644496.0000000001755000.00000004.00000020.00020000.00000000.sdmp, gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.5.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.5.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.5.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.5.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.5.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.5.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.5.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.5.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.5.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.5.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.5.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.5.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.5.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.5.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.5.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\gem1.exe

API call chain: ExitProcess graph end node

graph_2-49131

Source: C:\Users\user\Desktop\gem1.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_0048A710 RtlAcquirePebLock,NtAllocateVirtualMemory,NtAllocateVirtualMemory,lstrcpyW,lstrcatW,NtAllocateVirtualMemory,lstrcpyW,RtlInitUnicodeString,RtlInitUnicodeString,RtlInitUnicodeString,LdrEnumerateLoadedModules,RtlReleasePebLock,

2_2_0048A710

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_004BA04D IsDebuggerPresent,OutputDebugStringW,

2_2_004BA04D

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00498574 VirtualProtect ?,-00000001,00000104,?,?,?,0000001C

2_2_00498574

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00446400 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

2_2_00446400

Source: C:\Users\user\Desktop\gem1.exe	Code function: 0_2_028B7F09 mov edi, dword ptr fs:[00000030h]		0_2_028B7F09
Source: C:\Users\user\Desktop\gem1.exe	Code function: 0_2_028B8086 mov edi, dword ptr fs:[00000030h]		0_2_028B8086

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_004A6CD3 GetProcessHeap,

2_2_004A6CD3

Source: C:\Users\user\Desktop\gem1.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004AC6BF IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004AC6BF
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004AC80A SetUnhandledExceptionFilter,	2_2_004AC80A
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_00497B2D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00497B2D
Source: C:\Users\user\Desktop\gem1.exe	Code function: 2_2_004ABFD4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004ABFD4

Source: C:\Users\user\Desktop\gem1.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\gem1.exe

Code function: 0_2_028B7F09 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateProcessW,CreateProcessW,VirtualAlloc,VirtualAlloc,GetThreadContext,Wow64GetThreadContext,ReadProcessMemory,ReadProcessMemory,VirtualAllocEx,VirtualAllocEx,GetProcAddress,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,Wow64SetThreadContext,ResumeThread,ResumeThread,

0_2_028B7F09

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\gem1.exe

Memory written: C:\Users\user\Desktop\gem1.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_0047D2F0 ShellExecuteW,OpenProcessToken,GetCurrentProcess,GetTokenInformation,std::ios_base::_Ios_base_dtor,

2_2_0047D2F0

Source: C:\Users\user\Desktop\gem1.exe

Process created: C:\Users\user\Desktop\gem1.exe "C:\Users\user\Desktop\gem1.exe"

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00486C50 cpuid

2_2_00486C50

Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004A6109
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoEx,FormatMessageA,	2_2_004B824D
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,	2_2_004A620F
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_004A62E5
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	2_2_0049C70E
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C67
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C1A
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	2_2_004A5C1C
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,	2_2_0049CCB0
Source: C:\Users\user\Desktop\gem1.exe	Code function: EnumSystemLocalesW,	2_2_004A5D02
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_004A5D8D
Source: C:\Users\user\Desktop\gem1.exe	Code function: GetLocaleInfoW,	2_2_004A5FE0

Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\Users\user\Desktop\gem1.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Jump to behavior

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_00497EC8 GetSystemTimeAsFileTime,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,

2_2_00497EC8

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_004863F0 GetUserNameW,

2_2_004863F0

Source: C:\Users\user\Desktop\gem1.exe

Code function: 2_2_004A1074 GetTimeZoneInformation,

2_2_004A1074

Source: Amcache.hve.5.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.5.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: gem1.exe PID: 7488, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.gem1.exe.39def70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.39def70.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.38b9550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gem1.exe PID: 7488, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: gem1.exe, 00000002.00000002.1863644496.0000000001734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\config=
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectronCash\config
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Exodus\exodus.wallet
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore
Source: gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Ethereum\keystore

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOCK	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\CURRENT	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000001	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\gem1.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\gem1.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Remote Access Functionality

Yara detected CredGrabber

Source: Yara match

File source: Process Memory Space: gem1.exe PID: 7488, type: MEMORYSTR

Yara detected Meduza Stealer

Source: Yara match	File source: 0.2.gem1.exe.39def70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.gem1.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.39def70.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.gem1.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.gem1.exe.38b9550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gem1.exe PID: 7488, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	12 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	211 Process Injection	1 Software Packing	NTDS	34 System Information Discovery	Distributed Component Object Model	1 Email Collection	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	1 Query Registry	SSH	Keylogging	3 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	2 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	211 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gem1.exe	44%	Virustotal		Browse
gem1.exe	45%	ReversingLabs	Win32.Trojan.Jalapeno
gem1.exe	100%	Avira	HEUR/AGEN.1359509
gem1.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
api.ipify.org	104.26.12.205	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.5.dr	false		high
https://api.ipify.org/~	gem1.exe, 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	United States		13335	CLOUDFLARENETUS	false
66.63.187.173	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587387
Start date and time:	2025-01-10 10:13:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gem1.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/5@1/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 84 Number of non-executed functions: 44
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.182.143.212, 40.126.32.76, 20.109.210.53, 13.107.246.45
Excluded domains from analysis (whitelisted): ocsp.digicert.com, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, slscr.update.microsoft.com, otelrules.azureedge.net, blobcollector.events.data.trafficmanager.net, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:14:15	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	Yoranis Setup.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	RtU8kXPnKr.exe	Get hash	malicious	Quasar	Browse	api.ipify.org/
	jgbC220X2U.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=text
	xKvkNk9SXR.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	GD8c7ARn8q.exe	Get hash	malicious	TrojanRansom	Browse	api.ipify.org/
	8AbMCL2dxM.exe	Get hash	malicious	RCRU64, TrojanRansom	Browse	api.ipify.org/
	Simple2.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Ransomware Mallox.exe	Get hash	malicious	Targeted Ransomware	Browse	api.ipify.org/
	Yc9hcFC1ux.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse	api.ipify.org/
66.63.187.173	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.ipify.org	https://www.tremendous.com/email/activate/yE_yBdRtyVv4Xqgg7hu_	Get hash	malicious	Unknown	Browse	172.67.74.152
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.152
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	172.67.74.152
	https://vq6btbhdpo.nutignaera.shop/?email=YWxlamFuZHJvLmdhcnJpZG9Ac2VhYm9hcmRtYXJpbmUuY29t	Get hash	malicious	EvilProxy, HTMLPhisher	Browse	104.26.12.205
	EZZGTmJj4O.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	proforma invoice pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	mail (4).eml	Get hash	malicious	Unknown	Browse	172.67.74.152
	random.exe	Get hash	malicious	CStealer	Browse	104.26.12.205
	random.exe	Get hash	malicious	CStealer	Browse	172.67.74.152
	http://sammobile.digidip.net/visit?url=https://massageclinic.com.au/wadblacks2&currurl=https://www.sammobile.com/2018/06/06/june-2018-security-patch-information-published-by-samsung/	Get hash	malicious	Gabagool	Browse	104.26.13.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://pdfdrive.com.co	Get hash	malicious	Unknown	Browse	104.21.11.245
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	https://ctrk.klclick3.com/l/01JGXREPA9AKCFABSME4GFWDDZ_0#YWxhaW5femllZ2xlckB6aWVnbGVyZ3JvdXAuY29t	Get hash	malicious	Unknown	Browse	172.66.43.95
	http://www.singhs.lv	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.18.11.207
	http://18ofcontents.shop	Get hash	malicious	Unknown	Browse	104.21.96.1
	https://www.dcamarketintelligence.com/tdt	Get hash	malicious	Unknown	Browse	104.26.15.92
	1162-201.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	https://cdn.btmessage.com/	Get hash	malicious	HTMLPhisher	Browse	172.67.74.232
	http://www.austrata.net.au	Get hash	malicious	Unknown	Browse	1.1.1.1
	https://www.cineuserdad.ec	Get hash	malicious	Unknown	Browse	188.114.96.3
ASN-QUADRANET-GLOBALUS	armv5l.elf	Get hash	malicious	Unknown	Browse	104.237.80.14
	30% Order payment-BLQuote_'PO#385995790.exe	Get hash	malicious	AsyncRAT	Browse	69.174.100.131
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, XWorm, Xmrig	Browse	66.63.187.122
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	file.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	66.63.187.173
	Fantazy.spc.elf	Get hash	malicious	Unknown	Browse	104.223.10.34
	1.elf	Get hash	malicious	Unknown	Browse	72.11.146.74

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	FIWszl1A8l.exe	Get hash	malicious	GhostRat	Browse	104.26.12.205
	2873466535874-68348745.02.exe	Get hash	malicious	Unknown	Browse	104.26.12.205
	n41dQbiw1Y.exe	Get hash	malicious	Babuk, Djvu	Browse	104.26.12.205
	stage3.exe	Get hash	malicious	CobaltStrike	Browse	104.26.12.205
	1C24TDP_000000029.jse	Get hash	malicious	MassLogger RAT	Browse	104.26.12.205
	drop1.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.12.205
	DyM4yXX.exe	Get hash	malicious	Vidar	Browse	104.26.12.205
	http://cipassoitalia.it	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.26.12.205
	DHL_Awb_Shipping_Invoice_doc_010720257820020031808174CN1800301072025.bat.exe	Get hash	malicious	Remcos	Browse	104.26.12.205
	xCnwCctDWC.exe	Get hash	malicious	LummaC	Browse	104.26.12.205

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gem1.exe_daf150691981ac57c1cc14cff3d12fbabf996950_5a516dd6_359ee541-9ebf-4f51-9769-73b089985af5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8876693850403955
Encrypted:	false
SSDEEP:	96:zrFneJ2RZsrtcBjTOAqyS3QXIDcQlc6VcEdcw3d+BHUHZ0ownOgHkEwH3dEFYAKk:HFW2RZ4A0LR3saGGzuiFcXZ24IO8tg
MD5:	3A38398EF47A57EB036E9D6A43EE3ADF
SHA1:	00F7654E06069D414E51FA1AFB88132C929FBB18
SHA-256:	4E9442194B2B725C832215AFC9EF1CFA41DBB47A3C8B6EE8B05FEE37F7AC596B
SHA-512:	88D61FA4F8109CA9E8F05E2AAD935D2CC9ECF5FBBEB98D27D29C177C05ADDBA28DDE96B72649A7DBFFCF56A745A80706B7AFD02C8B0BF84AF9904E6B43CD9BA6
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.9.7.4.0.4.0.1.4.2.0.4.1.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.9.7.4.0.4.0.6.4.2.0.4.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.5.9.e.e.5.4.1.-.9.e.b.f.-.4.f.5.1.-.9.7.6.9.-.7.3.b.0.8.9.9.8.5.a.f.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.1.f.a.c.3.0.-.1.e.9.2.-.4.c.6.4.-.8.e.9.2.-.0.8.2.8.b.4.8.b.d.0.8.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.g.e.m.1...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.r.a.s.d.l.u.i...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.0.0.-.0.0.0.1.-.0.0.1.4.-.0.4.1.f.-.a.a.f.b.3.f.6.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.e.0.9.c.7.0.1.5.2.1.1.1.1.7.5.9.b.d.9.b.5.0.9.9.5.7.1.c.0.3.3.d.0.0.0.0.0.9.0.4.!.0.0.0.0.7.7.7.2.2.8.6.1.6.a.1.8.b.9.8.1.0.3.5.9.4.2.7.6.7.7.5.1.8.8.b.5.e.1.3.8.f.a.1.1.!.g.e.m.1...e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8C3.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Fri Jan 10 09:14:00 2025, 0x1205a4 type
Category:	dropped
Size (bytes):	150730
Entropy (8bit):	3.793986471299223
Encrypted:	false
SSDEEP:	1536:kujSQuBojRypN4uE2aOidLTgngJY1A0k0utTHAcACDyQY:ru0U4uEqSLTgwpscbN
MD5:	2E788C6D1440A3227A8AFF82AC7875A7
SHA1:	4DE8CAEA483E9F7815FDC775A8A8C39B709A04DE
SHA-256:	87427DD5B59B4902597C31BED9B56A5E771F0F3C41BEC6B6C70CE9F4AFEA277B
SHA-512:	D28752C4BACB6683D6A3CFAF9C948E29773BBA03A2FA6D983A01DA9492E853B7A48525401F1C005513BF465408802010F30FB046ABAFC9405D89B0BEA5AB3034
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... .........g....................................$...........d..../..........`.......8...........T...........($...(......................................................................................................eJ......P.......GenuineIntel............T.............g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD98F.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8378
Entropy (8bit):	3.687977762481962
Encrypted:	false
SSDEEP:	192:R6l7wVeJid64K6Y94LSU93iOgmf6sVJoprt89bLTsfYZm:R6lXJw6d6YcSU93iOgmf6sVJHL4fr
MD5:	799EA891B46A61FB3F66471356EF0207
SHA1:	7B516E1A3448DE5B87F406800B97E332BC96C1C7
SHA-256:	20586F598C94C50DD25BAAE05E91F2EAE5235511A7C9E87658933CA74F9CC26D
SHA-512:	526C3FD91FE2F6C472D3F07FC70947C7D1741D8F892AA09C36C17C76186C9B67AB31747905B21AD406F85AC72556C82463DEAE54E9B3C07ACC6EB9E8CB5EED04
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.2.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9AF.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4741
Entropy (8bit):	4.438754209378269
Encrypted:	false
SSDEEP:	48:cvIwWl8zsKJg77aI9TYWpW8VY2/Ym8M4J9dxPcf6FR+q8vedxPcfFjQ/TMJd:uIjfYI79R7VcJSfiKDfBQ/TMJd
MD5:	DEF52CAEB79A0A26A99A977C26D27916
SHA1:	0230224F2BDB51A2A48D7CFED11FE4CFD1BCA1DE
SHA-256:	44C8D18AEC30982B7DD5EA2B4AB7345689ADE4DD4854D27AB540848CDBCF0086
SHA-512:	69E0A573F987F8BC6F217D3BA3D38A843543D0F5D3B6B49E825D0BF8E08C95377EA00BB07743272D15F5F825EE019FEBB57594F79159FE8A1B5FD7793C24501E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="669616" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.466016876950458
Encrypted:	false
SSDEEP:	6144:cIXfpi67eLPU9skLmb0b4+WSPKaJG8nAgejZMMhA2gX4WABl0uN/dwBCswSba:hXD94+WlLZMM6YFHN+a
MD5:	06632F3C5B954690CC01716ECBE7098F
SHA1:	0A0EA024F51F6A63A62B29DA624CB85871937E65
SHA-256:	C67922EC43A9E9C2800932EE6645439AD1CE9A93241FB0855EAFA987F1DBB0FE
SHA-512:	043158F899AFA3ECA773EFC93C7559B87D5F26F98633BB251164E3C3FFABFFFADBCF26DF770DF1956018AF753C481C041AB12A0B9F92530F7A0611ECD8DC2CA5
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.G..?c..............................................................................................................................................................................................................................................................................................................................................w...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.995614545523129
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	gem1.exe
File size:	1'202'688 bytes
MD5:	d61ac037c333f1bc288c1a96a4db7c21
SHA1:	777228616a18b98103594276775188b5e138fa11
SHA256:	f5946e9f0ab4dbbd8d8171e708607c98df283cb1a6145444ba6a5f86bb2b0896
SHA512:	1aae796964099e22c3ebf8632ded9a451f01161ca6d837cd447524c58088ab05e0cfff6d297495e97b3b1a370b98b563937334f0306095b8c625641430288999
SSDEEP:	24576:R06mH2AfjusEQ3MWTwGxXjbAnpiYQ7eVGKtFwVrJL/tXjuD/:RLmH2AfisEQ5XInpI74arx/tXj+/
TLSH:	CB45330CFA0BDD2AC37E3D3704940F5095B0A39B1CABAD63744C715A87A65BB9E21E34
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..B...........a... ........@.. ...............................(....`................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40618e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xD2E802CF [Sun Feb 15 22:33:51 2082 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6140	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8000	0x622	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x60fb	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x4194	0x4200	11cdbebce84b96e38e64a2b9c59e8d1b	False	0.5025449810606061	data	5.882910829160536	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x8000	0x622	0x800	475a49e737227fab34df740bd3b803cb	False	0.35693359375	data	3.5546778997020008	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa000	0xc	0x200	08f8b9a9c6ae80bfba002f5f6811ac8c	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.bss	0xc000	0x120a00	0x120a00	87683f9c6e56b779ac24db4cddd7e7af	False	1.0003138195647467	data	7.999864651279933	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x80a0	0x398	OpenPGP Secret Key	English	United States	0.45760869565217394
RT_MANIFEST	0x8438	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T10:14:02.588084+0100	2049441	ET MALWARE Win32/Unknown Grabber Base64 Data Exfiltration Attempt	1	192.168.2.4	49730	66.63.187.173	15666	TCP
2025-01-10T10:14:02.588084+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	66.63.187.173	15666	TCP
2025-01-10T10:14:02.588084+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	66.63.187.173	15666	TCP
2025-01-10T10:14:02.593447+0100	2050806	ET MALWARE [ANY.RUN] Meduza Stealer Exfiltration M2	1	192.168.2.4	49730	66.63.187.173	15666	TCP
2025-01-10T10:14:02.593447+0100	2050807	ET MALWARE [ANY.RUN] Possible Meduza Stealer Exfiltration (TCP)	1	192.168.2.4	49730	66.63.187.173	15666	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 10:14:00.626399994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:00.631534100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:00.631620884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:00.691359997 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:00.691411972 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:00.691489935 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:00.698147058 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:00.698226929 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.235176086 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.235269070 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.309976101 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.310023069 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.310590982 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.310709000 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.313864946 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.355351925 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.421376944 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.421427965 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:01.421561956 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.421561956 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.422513962 CET	49731	443	192.168.2.4	104.26.12.205
Jan 10, 2025 10:14:01.422576904 CET	443	49731	104.26.12.205	192.168.2.4
Jan 10, 2025 10:14:02.588083982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.593281031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593312025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593338013 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593364954 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593390942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593446970 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.593487024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593513966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593556881 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.593561888 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593588114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593614101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.593650103 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.593739986 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.593813896 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598485947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598664045 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598695993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598725080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598751068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598754883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598778009 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598783970 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598803997 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598812103 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598850965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598855972 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598877907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598903894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598929882 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598933935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.598956108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598988056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.598989964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.599023104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.599052906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.603944063 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.603971004 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604017973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604020119 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604043961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604075909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604090929 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604115009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604118109 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604159117 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604173899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604202032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604231119 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604238987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604274988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604276896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604330063 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.604353905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.604410887 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609150887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609208107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609266996 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609293938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609325886 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609343052 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609344959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609369993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609417915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609426975 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609445095 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609467030 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609471083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609493971 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609503031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609520912 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609551907 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609553099 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609580994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609600067 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609606981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609627008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609653950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609653950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609679937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609707117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609711885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609724998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609754086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609757900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609781027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609806061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609807014 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609821081 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609833002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609855890 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609879971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609880924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609906912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609931946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609931946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609956980 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.609958887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.609972000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.610006094 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.610006094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.610033989 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.610049963 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.610078096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615060091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615086079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615115881 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615143061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615214109 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615269899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615295887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615331888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615345955 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615348101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615391016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615430117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615487099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615569115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615596056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615619898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615645885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615683079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615709066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615735054 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615748882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615761042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615776062 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615797043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615809917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615823984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615849018 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615852118 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615865946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615879059 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615900040 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615915060 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615921974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615942001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615956068 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.615984917 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.615989923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616010904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616030931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616046906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616054058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616074085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616091967 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616100073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616125107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616126060 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616137981 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616173983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616175890 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616203070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616225004 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616228104 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616247892 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616255045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616269112 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616281033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.616305113 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.616328955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.620196104 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620264053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.620359898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620385885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620498896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620524883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620526075 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.620570898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620598078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620615005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.620630026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.620650053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.620677948 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621237993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621263981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621298075 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621311903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621321917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621337891 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621367931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621390104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621408939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621436119 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621464968 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621481895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621489048 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621507883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621541023 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621555090 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621570110 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621582031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621608019 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621614933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621634960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621634960 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621653080 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621680975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621682882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621707916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621736050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621753931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621757030 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621781111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621818066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621826887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621840000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621853113 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621886015 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621902943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621903896 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.621929884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621974945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.621982098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622000933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622021914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622026920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622040987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622054100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622107029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622118950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622145891 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622168064 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622170925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622206926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622221947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.622250080 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.622277021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625093937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625153065 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625431061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625485897 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625570059 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625600100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625631094 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625663042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625695944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625722885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625755072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625768900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625777006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625796080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625822067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.625825882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625844955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.625868082 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.626243114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.626301050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627047062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627108097 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627175093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627202034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627228975 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627232075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627259016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627285004 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627296925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627357960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627424955 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627450943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627480984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627484083 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627506971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627520084 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627557039 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627573967 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627599955 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627629042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627645969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627651930 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627679110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627701044 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627724886 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627738953 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627752066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627780914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627798080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627804041 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627824068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627871037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627871037 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627899885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627929926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627942085 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.627955914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.627989054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628004074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628015041 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628031969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628057957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628062963 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628084898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628102064 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628104925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628133059 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628160000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628175020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628180027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628221035 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628231049 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628247976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628273964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.628281116 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628305912 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.628331900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.630040884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.630105019 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.630315065 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.630362988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.630637884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.630693913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.630760908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.630788088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.630829096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.630911112 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.630960941 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.630971909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.631026030 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.631041050 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.631067038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.631098032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.631099939 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.631124020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.631124020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.631151915 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.631170034 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.632152081 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.632179022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.632205963 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.632225990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.632229090 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.632255077 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.632283926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.632283926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.632317066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.632338047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633208036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633234024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633276939 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633286953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633312941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633338928 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633346081 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633364916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633373976 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633394957 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633413076 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633415937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633444071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633466959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633490086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633490086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633517981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633539915 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633546114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633563042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633570910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633608103 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633625984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633632898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633660078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633685112 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633691072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633709908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633722067 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633757114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633771896 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633783102 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633809090 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633816957 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633835077 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633836031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633856058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633882046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633886099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633909941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633934975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633936882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633960009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.633960962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.633985043 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.634006977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.634010077 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.634032965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.634059906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.634063005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.634087086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.634089947 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.634114027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.634114027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.634134054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.634191990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.635063887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635119915 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.635190964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635237932 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.635679007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635740995 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.635783911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635814905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635837078 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.635865927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.635936022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635962009 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.635992050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.636023045 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.636133909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.636194944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.636234045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.636260986 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.636290073 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.636310101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.636338949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.636364937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.636390924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.636411905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.637098074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.637145996 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.637151957 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.637171984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.637197971 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.637223959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.637316942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.637342930 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.637372017 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.637402058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639044046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639071941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639096975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639117956 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639148951 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639170885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639174938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639200926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639202118 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639224052 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639226913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639261007 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639280081 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639281988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639306068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639344931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639347076 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639370918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639377117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639416933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639422894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639439106 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639451027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639470100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639477968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639496088 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639503956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639529943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639538050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639555931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639556885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639583111 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639602900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639606953 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639630079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639655113 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639681101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639681101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639707088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639709949 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639733076 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639745951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639780045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639781952 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639806986 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639832973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639837980 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639858007 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639862061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639889002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639904022 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639915943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639941931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639965057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639967918 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.639987946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.639995098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640021086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640042067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640064955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640099049 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640151024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640206099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640618086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640666008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640676022 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640692949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640713930 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640737057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640902042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640928030 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640954018 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.640957117 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.640979052 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641004086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641123056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.641170025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.641176939 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641196966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.641227007 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641246080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.641269922 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641272068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.641300917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641321898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.641964912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.642019987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.642050028 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.642102957 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.642327070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.642353058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.642379045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.642383099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.642409086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.642409086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.642431021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.642457008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.644901037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.644927979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.644953966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.644957066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.644980907 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.644999027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645014048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645040035 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645073891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645101070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645108938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645128012 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645157099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645175934 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645178080 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645203114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645229101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645231009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645252943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645277023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645277977 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645303965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645329952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645334005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645356894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645375967 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645380974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645404100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645428896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645433903 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645457029 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645458937 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645482063 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645483017 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645507097 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645509005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645529032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645560980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645565987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645587921 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645606995 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645613909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645632982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645641088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645668983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645688057 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645690918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645714998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645740032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645741940 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645761967 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645766973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645786047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645793915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645819902 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645828009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645865917 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645867109 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645894051 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645919085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645925045 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645945072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645947933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645966053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645971060 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.645988941 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.645998001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646023035 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646023989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646045923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646049976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646073103 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646096945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646106958 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646123886 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646151066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646153927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646174908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646177053 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646194935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646204948 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646230936 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646235943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646258116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646258116 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646295071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646306038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646322966 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646332979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646378040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646387100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646404982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646420956 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646431923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646450043 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646472931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.646874905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.646929979 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.647078037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.647134066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.647295952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.647342920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.647349119 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.647368908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.647406101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.647439003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.647492886 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.647542000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651402950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651432037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651458025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651489973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651510954 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651539087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651563883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651565075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651592016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651612997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651638031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651639938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651667118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651693106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651696920 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651719093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651721001 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651741982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651766062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651774883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651792049 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651818037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651825905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651844025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651890039 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651891947 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651916981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651937962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651942015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651968002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.651968956 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651988983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.651994944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652015924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652021885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652043104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652071953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652076006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652098894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652123928 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652128935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652152061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652154922 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652177095 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652178049 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652204037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652205944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652225971 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652250051 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652250051 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652276993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652302027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652303934 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652328014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652329922 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652354002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652358055 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652379990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652380943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652400970 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652407885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652432919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652445078 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652466059 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652481079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652486086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652508974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652535915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652535915 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652561903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652568102 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652587891 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652595997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652614117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652617931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652640104 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652643919 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652667046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652667046 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652688980 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652693987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652719975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652731895 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652745962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652771950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652786970 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652808905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652820110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652846098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652870893 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652873993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652896881 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652896881 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652923107 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652925968 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652949095 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.652949095 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652976036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.652986050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653002024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.653013945 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653028965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.653044939 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653054953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.653080940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.653084993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653104067 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653105974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.653127909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653134108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.653168917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.653194904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.657959938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.658019066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.680227041 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.680600882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.680825949 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.680879116 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.685631037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.685713053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.685817957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.685846090 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.685873032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.685899019 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.685924053 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.685976982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686002016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686028004 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686027050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686054945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686079979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686125994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686131954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686151981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686173916 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686180115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686192989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686207056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686229944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686233044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686250925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686259031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686304092 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686306000 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686333895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686358929 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686361074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686383009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686384916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686404943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686410904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686431885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686436892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686451912 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686489105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686496019 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686515093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686537981 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686543941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686570883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686570883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686599016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.686599970 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686621904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.686641932 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.728310108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.728719950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.728935003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.728996038 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.776268005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.776667118 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.776886940 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.776946068 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.781780005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.781958103 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.781986952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782012939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782040119 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782038927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782067060 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782094002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782119036 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782141924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782156944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782171011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782197952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782198906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782223940 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782224894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782248974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782252073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782270908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782279015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782326937 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782327890 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782355070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782381058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782392025 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782407045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782432079 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782433033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782454967 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782459974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782478094 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782488108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782550097 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782548904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782577991 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782604933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782624960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782632113 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782649994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782660007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782675982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782707930 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782710075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782737970 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782763958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782783985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782790899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782816887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782843113 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782849073 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782875061 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782892942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782902002 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782919884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782944918 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782946110 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782970905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.782980919 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.782998085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783003092 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783023119 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783025026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783042908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783051968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783088923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783099890 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783116102 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783128023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783154011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783154011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783179045 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783180952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783200026 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783207893 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783225060 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783235073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783257008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783262968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783278942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783288956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783310890 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783337116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783360958 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783396006 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783397913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783426046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783447981 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783452988 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783473969 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783480883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783502102 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783509016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783529997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783536911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783564091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783590078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783595085 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783616066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783620119 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783642054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783643007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783664942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783670902 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783696890 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783730984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783745050 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783752918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783772945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783792973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783799887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783816099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783828020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783850908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783853054 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783879995 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783895016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783906937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783930063 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.783934116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783962011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.783967972 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.784009933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.788772106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.788845062 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.788892984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.788922071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.788952112 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.788969040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.788978100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.788996935 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789022923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789022923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789045095 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789051056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789068937 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789079905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789098024 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789129972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789141893 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789156914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789182901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789185047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789207935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789208889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789239883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789262056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789266109 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789288998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789314985 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789314985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789335012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789340973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789390087 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789391994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789417982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789444923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789475918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789491892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789500952 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789519072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789546013 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789546013 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789570093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789576054 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789594889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789603949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789650917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789654970 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789681911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789707899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789710999 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789732933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789736032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789764881 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789778948 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789784908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789805889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789832115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789832115 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789853096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789860010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789886951 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789896011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789931059 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.789932966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789959908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789985895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.789988041 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790011883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790014029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790034056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790039062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790079117 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790088892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790117025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790148020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790162086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790169954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790189028 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790211916 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790215015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790230989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790241957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790266991 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790288925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790288925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790316105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790337086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790343046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790359974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790369034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790411949 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790416002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790443897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790467978 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790468931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790493965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790513039 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790515900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790544987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790570021 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790596008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790596962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790621996 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790626049 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790649891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790668011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790673018 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790702105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790729046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790730953 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790755033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790756941 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790782928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790801048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790802002 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790827990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790854931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790855885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790878057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790883064 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790899992 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790910959 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790937901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790944099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790966988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.790985107 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.790987968 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791013002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.791038036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.791038990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791064978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.791065931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791085958 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791093111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.791117907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.791119099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791140079 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791143894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.791176081 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.791197062 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796008110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796082973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796109915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796194077 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796196938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796221972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796269894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796282053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796298027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796329975 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796344042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796355963 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796370983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796390057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796397924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796425104 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796432018 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796461105 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796472073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796499968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796525955 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796554089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796560049 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796601057 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796602964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796627998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796653986 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796657085 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796679020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796679974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796710968 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796732903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796737909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796761036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796787024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796791077 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796813965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796814919 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796839952 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796839952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796868086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796885014 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796911001 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796916962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796930075 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796947956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796973944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.796979904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.796998978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797002077 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797023058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797039986 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797050953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797077894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797101021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797103882 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797121048 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797131062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797152996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797177076 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797178030 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797205925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797230959 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797230959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797254086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797257900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797272921 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797296047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797307014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797333956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797355890 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797358990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797377110 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797385931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797401905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797416925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797440052 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797442913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.797460079 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.797482967 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.838278055 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.838690996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.838932991 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.839006901 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.843986034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844124079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844151974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844157934 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844180107 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844233036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844242096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844259977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844281912 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844288111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844315052 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844319105 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844348907 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844367981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844369888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844394922 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844422102 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844430923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844449043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844475985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844497919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844500065 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844525099 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844552994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844553947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844574928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844580889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844594002 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844609022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844635010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844647884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844680071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844681025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844708920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844733953 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844734907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844753027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844763041 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844777107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844789982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844813108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844818115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844840050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844846010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844865084 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844872952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844914913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.844922066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844949961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844974995 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.844985962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845000982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845010042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845026970 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845031977 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845052004 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845053911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845073938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845081091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845107079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845113039 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845132113 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845133066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845151901 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845181942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845182896 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845210075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845237017 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845237970 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.845262051 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.845292091 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.892353058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.892671108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.892930031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.893044949 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.910861015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.911277056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.911501884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.911603928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916337967 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916502953 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916527987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916558981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916579962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916587114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916614056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916614056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916642904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916656017 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916670084 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916696072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916714907 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916718960 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916745901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916771889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916774988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916798115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916811943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916841984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916845083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916872025 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916930914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.916951895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.916979074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917005062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917007923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917030096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917032957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917049885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917059898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917073965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917087078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917105913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917131901 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917134047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917161942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917187929 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917191029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917212963 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917212963 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917237997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917260885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917263985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917287111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917314053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917334080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917347908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917360067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917390108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917406082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917411089 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917433023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917459011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917459965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917484999 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917484999 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917514086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917534113 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917536974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917565107 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917593002 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917594910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917619944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917622089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917640924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917670965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917679071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917697906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917723894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917743921 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917748928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917771101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917798042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917799950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917821884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917824030 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917870998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917872906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917897940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917923927 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.917927980 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917947054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.917973042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.960268974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.960663080 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.960887909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.960959911 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.972358942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.972713947 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.972942114 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.973011017 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.977762938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.977906942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.977925062 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.977933884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.977967978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.977998018 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978014946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978035927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978060961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978070974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978089094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978120089 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978142023 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978164911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978192091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978224039 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978231907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978245974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978279114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978287935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978313923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978343964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978358984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978364944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978389978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978415012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978435993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978468895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978496075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978528023 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978543043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978548050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978570938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978602886 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978624105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978631020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978652000 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978692055 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978698015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978725910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978749037 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978770971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978774071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978799105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978827000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978844881 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978847980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978876114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978902102 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978904009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978925943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978928089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978956938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.978976011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.978979111 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979002953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979028940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979031086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979053020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979054928 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979073048 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979103088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979111910 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979130030 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979151964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979156971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979171991 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979183912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979202986 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979211092 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979231119 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979237080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979263067 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979285002 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979291916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979338884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979343891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979366064 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979393005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979397058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979418039 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979420900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979440928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979445934 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979479074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979492903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979501009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979520082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979547024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979551077 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979572058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979573965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979593992 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979602098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979624987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979629040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979650021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979676962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979684114 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979703903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979728937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979733944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979754925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979756117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979783058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979783058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979801893 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979830027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979847908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979857922 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979880095 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979885101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979912996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979933023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.979940891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.979959965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980001926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980005980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980035067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980066061 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980093002 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980118036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980144978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980170012 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980190039 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980226994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980257034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980283022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980309010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980329990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980340958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980360031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980369091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.980392933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.980433941 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.982978106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.983031034 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.984812975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.984982014 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985071898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985136986 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985142946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985200882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985332966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985358953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985397100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985428095 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985474110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985487938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985539913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985543966 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985572100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985599995 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985626936 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985636950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985685110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985697985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985714912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985732079 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985763073 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985780001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985825062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985836983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985872984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985909939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985940933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985965014 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.985990047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.985991955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986021042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986047029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986068964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986078978 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986125946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986133099 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986162901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986192942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986222029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986227989 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986275911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986284018 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986337900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986339092 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986394882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986426115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986481905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986489058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986536980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986552954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986577988 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986599922 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986643076 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986713886 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986741066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986767054 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986768961 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986807108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986818075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986845016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986876011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986891031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986910105 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986917973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.986954927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986982107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.986983061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987011909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987037897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987042904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987068892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987076998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987124920 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987133980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987162113 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987185955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987188101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987215996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987236023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987242937 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987262011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987304926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.987833023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.987890005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.989867926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.989924908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.989960909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.990010977 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.990031958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.990083933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.990130901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.990189075 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.990428925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.990480900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.990586042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.990652084 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.990844965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.990897894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.991045952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.991101980 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.991108894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.991161108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.991280079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.991349936 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.991385937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.991417885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:02.991441965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:02.991485119 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.032444000 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.032830000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.033066988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.033154964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.043179989 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.043538094 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.043772936 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.043862104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.048744917 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.048796892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.048824072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.048868895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.048981905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049004078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049098969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049125910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049155951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049196005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049201012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049282074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049297094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049356937 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049412012 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049438953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049469948 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049480915 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049520016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.049581051 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049612045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049674034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049762011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049804926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049951077 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.049959898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050013065 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050074100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050139904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050170898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050232887 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050266981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050329924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050332069 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050379038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050384998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050437927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050458908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050513983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050523043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050587893 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050637007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050694942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050741911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050789118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050812006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050820112 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050841093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050885916 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.050930023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050976038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.050986052 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051026106 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051060915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051115990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051203966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051230907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051259995 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051285982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051343918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051367998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051424026 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051486015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051544905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051872969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051899910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051930904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.051949978 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.051995993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052041054 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052097082 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052153111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052180052 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052222013 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052242994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052290916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052313089 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052345037 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052409887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052474976 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052593946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052627087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.052649021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.052714109 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054089069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054146051 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054202080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054260015 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054316044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054343939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054373026 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054404020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054541111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054600000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054696083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054759026 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054832935 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054889917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.054899931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.054980993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055041075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055094004 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055164099 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055221081 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055344105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055373907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055429935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055527925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055561066 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055588961 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055627108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055723906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055779934 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055810928 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055866957 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.055939913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.055994987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056067944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056135893 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056194067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056245089 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056302071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056366920 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056396008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056464911 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056567907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056629896 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056642056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056699038 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056725979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056781054 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056848049 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.056911945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.056969881 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057003021 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057060003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057228088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057337046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057396889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057430983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057486057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057507992 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057574987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057604074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057656050 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057660103 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057713985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057743073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057799101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057818890 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057873964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.057883024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057928085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.057936907 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058021069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058080912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058082104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058155060 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058212996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058228016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058274031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058285952 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058347940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058408976 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058423042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058497906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058557987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058574915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058621883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058687925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058708906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058773041 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058778048 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058829069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058885098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.058893919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.058983088 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059041977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059098005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059189081 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059242010 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059264898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059328079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059330940 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059386969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059446096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059612036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059669971 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059673071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059870958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059876919 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.059895992 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.059953928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.060071945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.060209036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.060266018 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.060978889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.060992956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061027050 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061086893 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.061275005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061342955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.061393023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061405897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061459064 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.061464071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061539888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.061569929 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061791897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061851025 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.061904907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.061966896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062014103 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062026024 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062083006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062252998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062303066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062352896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062366009 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062395096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062446117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062505960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062532902 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062550068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062565088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062628031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062654018 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062711000 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062752008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062916040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.062973976 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.062985897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063114882 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063127041 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063174009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.063195944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063244104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.063278913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063327074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.063355923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063431978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063482046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063492060 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.063541889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.063651085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063862085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063916922 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.063930988 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.063998938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064047098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064049959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064085007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064138889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064191103 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064203978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064214945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064245939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064270973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064281940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064306974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064325094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064340115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064383984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064466000 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064557076 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064728022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064740896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064800024 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.064863920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064877987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.064930916 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.065135002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.065232038 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.065248966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.065304995 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.065990925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066049099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066054106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066101074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066167116 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066184044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066231012 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066232920 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066266060 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066322088 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066340923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066394091 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066440105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066469908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066483021 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066489935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066515923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066544056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066555977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066577911 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066632032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066673994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066706896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066759109 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066865921 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066916943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.066951990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.066963911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067013979 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067116022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067198038 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067302942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067352057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067385912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067400932 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067430973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067454100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067487955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067493916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067509890 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067553997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067636013 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067684889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.067787886 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067800999 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.067857981 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068054914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068104982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068136930 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068161011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068192959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068198919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068213940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068245888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068272114 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068300962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068346977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068356991 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068387985 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068449020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068728924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068770885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068784952 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068844080 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068850994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.068955898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.068977118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069025993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069057941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069144964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069154024 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069195032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069196939 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069236040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069276094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069319010 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069370031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069423914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069463015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069529057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069582939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069597006 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069610119 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069623947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069655895 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069658041 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069711924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069741964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069777966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.069787025 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069818020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.069822073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.070135117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.070204973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.070224047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.070697069 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.070853949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.070949078 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071027994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071077108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071109056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071175098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071182966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071233034 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071273088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071341038 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071624994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071639061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071654081 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071666956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071680069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071688890 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071692944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071717978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071731091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071743011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071748018 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071774006 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071794033 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071827888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071832895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071882963 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071898937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.071938992 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.071995020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072050095 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.072210073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072328091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072357893 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072402954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.072424889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072469950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.072531939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072546005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072559118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072599888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.072643042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.072679996 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072725058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.072793961 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.072971106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073030949 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073059082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073095083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073139906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073144913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073182106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073235989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073271990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073323011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073344946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073358059 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073409081 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073642015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073666096 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073704004 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073800087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073859930 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.073901892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073945999 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.073998928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074006081 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074060917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074074984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074193954 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074228048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074256897 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074296951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074300051 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074326992 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074351072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074381113 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074433088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074481964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074522972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074578047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074635029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074676991 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074736118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074800014 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.074803114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074892044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074914932 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.074956894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.075016022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.075030088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.075089931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.075488091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.075558901 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.075748920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.075799942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.075850964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076030016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.076040983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076108932 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076168060 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.076216936 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076267958 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.076543093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076611042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076661110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076670885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.076674938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076719046 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.076771021 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076823950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076884031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.076891899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.076970100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077013016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077033043 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077073097 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077084064 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077099085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077138901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077158928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077177048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077224016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077250957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077272892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077325106 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077334881 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077394962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077435017 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077460051 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077481031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077517986 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077578068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077591896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077605009 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077627897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077636003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077663898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077680111 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077701092 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077747107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.077821970 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.077960968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078027964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078043938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078079939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078105927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078119040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078136921 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078233957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078283072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078325033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078386068 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078387976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078404903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078466892 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078641891 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078710079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078715086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078810930 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078874111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078881025 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.078924894 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.078986883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079006910 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079055071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079139948 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079206944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079282999 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079298973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079380035 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079438925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079453945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079492092 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079498053 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079552889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079592943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079652071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079713106 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079754114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079783916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079807997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079843044 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079844952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079894066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.079904079 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.079958916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080010891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.080053091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080102921 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.080120087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080215931 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.080415964 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080427885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080487013 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.080717087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080774069 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.080836058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.080885887 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081018925 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081077099 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081172943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081186056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081234932 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081533909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081577063 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081597090 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081638098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081676006 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081727982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081753016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081768990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081790924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081811905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081851959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.081916094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.081954002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082011938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082041979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082091093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082107067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082159042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082196951 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082220078 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082266092 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082294941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082323074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082380056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082402945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082417011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082457066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082540035 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082571983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082596064 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082643032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082669973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082683086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082695961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082716942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082752943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082777977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082787037 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082817078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082823992 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082909107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.082932949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.082999945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083014011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083070040 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083082914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083121061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083174944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083204985 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083259106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083283901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083334923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083669901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083683014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083694935 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083717108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083728075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083754063 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083803892 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083852053 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083892107 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.083909035 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083934069 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.083944082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084085941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084098101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084162951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084213972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084319115 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084352016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084474087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084492922 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084530115 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084582090 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084614038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084651947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084666014 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084685087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084703922 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084728003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084734917 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084789991 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.084800959 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084832907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084878922 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.084884882 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.085092068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085104942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085148096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.085341930 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085382938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085392952 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.085689068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085752010 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.085758924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085891962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.085951090 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.086162090 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086175919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086221933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.086370945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086487055 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086539984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.086611986 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086642981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086702108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.086741924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086756945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086811066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.086860895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.086972952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087024927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087075949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087106943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087157011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087186098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087225914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087274075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087285042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087321043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087376118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087376118 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087392092 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087420940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087445974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087490082 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087507963 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087603092 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087655067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087660074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087713957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087765932 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087776899 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087778091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087801933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087827921 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087850094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.087866068 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.087949038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088001966 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088007927 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088112116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088124037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088175058 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088185072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088198900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088215113 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088253975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088258028 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088293076 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088568926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088634968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088665009 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088690996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088720083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088726997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088759899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088781118 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.088828087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088841915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.088890076 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089046001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089072943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089087009 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089096069 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089129925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089135885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089200974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089267015 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089437962 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089525938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089570999 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089580059 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089672089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089719057 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089726925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089766026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089813948 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089818954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089853048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089888096 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089900017 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.089915037 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.089951038 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.090024948 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090044975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090075016 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.090104103 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.090109110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090157986 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.090193033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090549946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090605021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.090611935 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090845108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.090912104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.090933084 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091058016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091094971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091110945 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.091156006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.091583014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091597080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091610909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091623068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091639996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.091675997 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.091682911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091717005 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091733932 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.091748953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091798067 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.091912031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.091984034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092031956 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092036009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092097044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092149019 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092189074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092238903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092298985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092353106 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092367887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092397928 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092418909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092466116 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092474937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092530012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092534065 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092592001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092645884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092648983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092708111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092722893 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.092771053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.092942953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093010902 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093071938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093127012 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093138933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093188047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093283892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093305111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093318939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093362093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093374014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093420982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093556881 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093643904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093657017 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093709946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093734980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093786955 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093791008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093801975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093854904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.093894958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093908072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093936920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.093961954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094010115 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094103098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094125032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094166994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094177961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094433069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094485044 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094504118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094542027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094569921 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094597101 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094640017 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094644070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094702959 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094752073 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094758987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094806910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094839096 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094868898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094913960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.094924927 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094964981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.094971895 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.095006943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095067024 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.095077991 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095091105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095144033 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.095505953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095562935 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.095563889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095783949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095846891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.095870018 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.095921040 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.096065044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096077919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096116066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.096154928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.096189976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096343040 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.096577883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096657038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096709967 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.096770048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096782923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096838951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.096873045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.096960068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097017050 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097105026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097168922 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097222090 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097261906 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097316027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097362041 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097381115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097440958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097498894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097505093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097594976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097647905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097676039 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097798109 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097821951 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097860098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097860098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.097908020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.097961903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098015070 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098040104 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098079920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098156929 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098185062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098232985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098297119 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098345995 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098398924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098450899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098459959 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098517895 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098563910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098628044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098644018 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098684072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098704100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098754883 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098815918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098836899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098887920 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.098896027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.098999977 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099039078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099052906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099097013 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099137068 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099184990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099212885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099267006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099287033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099339008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099445105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099508047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099529982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099577904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099582911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099682093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099704981 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099741936 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.099814892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099909067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099963903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.099967957 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100040913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100095987 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100107908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100178003 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100224972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100233078 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100275040 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100316048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100383043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100430965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100512028 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100524902 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100575924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100608110 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100651026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100663900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100704908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100733042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100807905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100814104 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100852013 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.100852966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.100914955 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101031065 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101043940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101057053 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101104975 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101121902 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101164103 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101172924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101192951 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101217985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101244926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101351976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101365089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101418972 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101464987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101519108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101572990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101747036 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101771116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101820946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101859093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101912022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.101918936 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.101967096 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102006912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102060080 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102097034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102150917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102190971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102241993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102288008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102345943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102345943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102400064 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102406979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102452040 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102497101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102526903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102572918 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102623940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102659941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102678061 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102706909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102739096 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102756023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102809906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.102886915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102900982 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102936983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.102952003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103003025 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103015900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103029013 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103081942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103152037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103213072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103280067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103295088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103342056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103401899 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103457928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103507996 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103521109 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103574991 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103698015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103744984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103765011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103780031 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103832006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103878975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.103935003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.103974104 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104026079 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104064941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104087114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104120970 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104159117 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104208946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104263067 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104379892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104430914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104446888 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104477882 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104501009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104545116 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104588032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104684114 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104724884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104743004 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104787111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104798079 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104840994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104846001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104895115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104906082 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.104928017 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104948044 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.104970932 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105010986 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105053902 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105124950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105139017 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105176926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105292082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105345964 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105393887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105452061 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105515957 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105546951 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105570078 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105609894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105660915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105710983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105832100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105844975 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105884075 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.105896950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105942011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.105959892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106010914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106096983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106138945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106149912 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106185913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106189013 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106241941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106244087 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106293917 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106354952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106368065 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106419086 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106425047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106470108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106472015 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106518984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106522083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106575012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106687069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106791973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106806993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106820107 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106832027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106846094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106865883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106906891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106908083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.106967926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.106986046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107002974 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107042074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107110023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107161999 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107172012 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107223988 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107347965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107361078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107372046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107414961 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107450008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107507944 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107530117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107578993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107685089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107697010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107732058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107743979 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107791901 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107832909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107883930 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.107887030 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.107953072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108002901 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108028889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108089924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108098984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108143091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108153105 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108206034 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108217955 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108270884 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108310938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108361006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108387947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108438969 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108474016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108527899 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108568907 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108608007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108622074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108660936 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108664989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108684063 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108716011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108755112 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108762026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108813047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108819008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108861923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108875036 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108922005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.108949900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.108964920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109018087 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109051943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109074116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109108925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109117985 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109142065 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109160900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109170914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109210968 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109256983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109302998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109399080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109452009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109502077 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109515905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109565020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109570026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109627962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109637976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109653950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109707117 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109754086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109796047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109807968 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109843016 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109854937 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.109910011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109930992 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.109971046 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.110034943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110047102 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110060930 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110102892 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.110292912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110433102 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110486984 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.110522032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110559940 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110580921 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110595942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.110631943 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.110867023 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.110920906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.110969067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111061096 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111083031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111103058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111110926 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111157894 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111160994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111211061 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111229897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111279011 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111288071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111345053 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111392021 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111474037 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111489058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111511946 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111546993 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111573935 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111583948 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111587048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111617088 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111653090 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111665010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111691952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111747026 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111831903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111845970 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111888885 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111896038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111938953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111946106 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.111977100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.111994028 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112021923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112042904 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112082958 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112210035 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112222910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112234116 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112277031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112309933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112310886 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112349033 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112360001 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112426043 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112437010 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112452030 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112509966 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112517118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112564087 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112576008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112631083 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112634897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112677097 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112711906 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112751961 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112790108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112813950 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112874031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.112907887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112951040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.112955093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.113020897 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.113066912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.113085032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.113138914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.113159895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.113195896 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.113215923 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.113259077 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.113266945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.113303900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.113320112 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.113359928 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114346027 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114423990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114486933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114511967 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114582062 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114584923 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114618063 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114646912 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114654064 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114690065 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114737034 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114749908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114799976 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114804983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114842892 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114852905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.114909887 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.114994049 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115045071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115045071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115057945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115114927 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115118027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115156889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115168095 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115237951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115238905 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115298033 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115493059 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115547895 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115569115 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115581989 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115596056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115636110 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115736961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115798950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115845919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115904093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.115923882 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115962029 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.115992069 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116017103 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116018057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116077900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116117954 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116174936 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116215944 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116266012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116333008 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116384029 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116445065 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116478920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116504908 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116533041 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116535902 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116584063 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116632938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116641998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116708994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116708994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116759062 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116822958 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116835117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116847038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116895914 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.116966963 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.116978884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117017031 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117047071 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117049932 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117146015 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117160082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117172003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117212057 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117223978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117255926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117316008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117347002 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117382050 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117432117 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117443085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117465973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117506027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117598057 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117609978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117620945 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117666006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117685080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117738008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117739916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117785931 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117845058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117846012 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117894888 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.117912054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117949963 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.117984056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.118005037 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.118036032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.118036985 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.118079901 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.118274927 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.118287086 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.118299961 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.118346930 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.122792959 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122833014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122844934 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122848034 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.122858047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122881889 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.122889042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122904062 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122915983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122915983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.122927904 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122941017 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122952938 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122953892 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.122965097 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122977972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122988939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.122992992 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123011112 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123023987 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123034954 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123034954 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123049021 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123060942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123073101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123085022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123096943 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123097897 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123107910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123127937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123141050 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123152971 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123164892 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123169899 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123176098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123182058 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123188019 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123193026 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123203993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123215914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123223066 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123226881 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123239040 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123276949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123289108 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123289108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123300076 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123373985 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123435020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123447895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123459101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123529911 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123562098 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123575926 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123634100 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123673916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123725891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123832941 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123886108 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.123974085 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.123986959 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124037027 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124106884 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124119997 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124130011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124182940 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124324083 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124336004 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124346972 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124385118 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124433994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124490023 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124695063 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124707937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124752998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124794960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124819994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124831915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124844074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124855042 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.124871969 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124908924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.124970913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125066996 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125097990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125109911 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125122070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125149965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125197887 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125210047 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125222921 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125233889 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125245094 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125257969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125269890 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125272989 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125315905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125349998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125349998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125363111 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125375032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125386000 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125402927 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125437975 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125505924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125582933 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125632048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125643969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125654936 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125665903 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125696898 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125719070 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.125726938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.125771999 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.129905939 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.129930973 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.129952908 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130044937 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130119085 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130168915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130193949 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130222082 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130255938 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130311966 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130336046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130567074 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130640984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130666018 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130697966 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130738974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130762100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130826950 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.130907059 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130932093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.130975962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131045103 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131103039 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131201029 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131225109 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131247997 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131258965 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131303072 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131365061 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131390095 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131422043 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131450891 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131469965 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131494045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131516933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131541967 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131542921 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131571054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131596088 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131623983 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131648064 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131670952 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131676912 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131711960 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131756067 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131779909 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131807089 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131818056 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131861925 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.131901979 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.131957054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132040024 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132066011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132088900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132098913 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132114887 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132137060 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132138968 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132163048 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132165909 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132188082 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132193089 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132211924 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132236004 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132261038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132270098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132285118 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132308960 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132311106 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132333994 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132337093 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132358074 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132364035 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132381916 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132405043 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132411003 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132428885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132452011 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132462025 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132476091 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132493973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132499933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132524014 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132536888 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132550001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132567883 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132575035 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132599115 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132600069 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132632971 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132642984 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132674932 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132678032 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132704020 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132704973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132728100 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132733107 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132751942 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132760048 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132776022 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132785082 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132801056 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132822990 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132824898 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132848978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132867098 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132872105 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132895947 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132898092 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132919073 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132935047 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132942915 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132966995 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.132966995 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.132991076 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133014917 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133019924 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133038998 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133063078 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133064032 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133086920 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133088112 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133110046 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133126974 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133135080 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133152962 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133158922 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133177042 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133184910 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133208990 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133212090 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133232117 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133255005 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133261919 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133285046 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133291006 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.133316994 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.133348942 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.134994030 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135040045 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135056973 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135118008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135183096 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135235071 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135257006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135258913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135303020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135353088 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135406971 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135476112 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135504007 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135560989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135632038 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135657072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135684013 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135714054 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135756969 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135799885 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135813951 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135853052 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.135891914 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135921001 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.135962009 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.136008978 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.136075020 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.136265993 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.136322021 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.136351109 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.136409998 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.136466980 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.136545897 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.136642933 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.136698008 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.136714935 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.136837006 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.141431093 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.141669989 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.141783953 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.141843081 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.142175913 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142188072 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142199039 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142221928 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142232895 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142241001 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.142244101 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142257929 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.142297983 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.142345905 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.184300900 CET	15666	49730	66.63.187.173	192.168.2.4
Jan 10, 2025 10:14:03.184511900 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.184685946 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.184782982 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.184900999 CET	49730	15666	192.168.2.4	66.63.187.173
Jan 10, 2025 10:14:03.184983969 CET	49730	15666	192.168.2.4	66.63.187.173

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 10:14:00.678725958 CET	192.168.2.4	1.1.1.1	0x144	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 10:14:00.685592890 CET	1.1.1.1	192.168.2.4	0x144	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:14:00.685592890 CET	1.1.1.1	192.168.2.4	0x144	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Jan 10, 2025 10:14:00.685592890 CET	1.1.1.1	192.168.2.4	0x144	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	104.26.12.205	443	7488	C:\Users\user\Desktop\gem1.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 09:14:01 UTC	100	OUT	GET / HTTP/1.1 Accept: text/html; text/plain; / Host: api.ipify.org Cache-Control: no-cache
2025-01-10 09:14:01 UTC	424	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 09:14:01 GMT Content-Type: text/plain Content-Length: 12 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 8ffb8dee8e177c8e-EWR server-timing: cfL4;desc="?proto=TCP&rtt=2013&min_rtt=2003&rtt_var=772&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2819&recv_bytes=738&delivery_rate=1398467&cwnd=248&unsent_bytes=0&cid=d1b1a13b93f9bfc5&ts=201&x=0"
2025-01-10 09:14:01 UTC	12	IN	Data Raw: 38 2e 34 36 2e 31 32 33 2e 31 38 39 Data Ascii: 8.46.123.189

Target ID:	0
Start time:	04:13:59
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\gem1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gem1.exe"
Imagebase:	0x470000
File size:	1'202'688 bytes
MD5 hash:	D61AC037C333F1BC288C1A96A4DB7C21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:13:59
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:13:59
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\gem1.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gem1.exe"
Imagebase:	0xfe0000
File size:	1'202'688 bytes
MD5 hash:	D61AC037C333F1BC288C1A96A4DB7C21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.1863644496.00000000016E8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MeduzaStealer, Description: Yara detected Meduza Stealer, Source: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: infostealer_win_meduzastealer, Description: Finds MeduzaStealer samples based on specific strings, Source: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Sekoia.io
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:13:59
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7424 -s 920
Imagebase:	0x630000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	36.8%
Total number of Nodes:	19
Total number of Limit Nodes:	2

Executed Functions

Function 028B7F09 Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028B7E7B,028B7E6B), ref: 028B80A1
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028B80B4
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 028B80D2
ReadProcessMemory.KERNELBASE(0000009C,?,028B7EBF,00000004,00000000), ref: 028B80F6
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 028B8121
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 028B8179
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 028B81C4
WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 028B8202
Wow64SetThreadContext.KERNEL32(000000A0,02770000), ref: 028B823E
ResumeThread.KERNELBASE(000000A0), ref: 028B824D

Strings

VirtualAllocEx, xrefs: 028B8009
Load, xrefs: 028B7F47
ResumeThread, xrefs: 028B8045
SetThreadContext, xrefs: 028B802F
CreateProcessW, xrefs: 028B7FBD
ReadProcessMemory, xrefs: 028B7FF6
TerminateProcess, xrefs: 028B8130
GetThreadContext, xrefs: 028B7FE3
WriteProcessMemory, xrefs: 028B801C
VirtualAlloc, xrefs: 028B7FD0
ress, xrefs: 028B7F93
GetP, xrefs: 028B7F8B
aryA, xrefs: 028B7F4F

Memory Dump Source

Source File: 00000000.00000002.1845353895.00000000028B7000.00000040.00000800.00020000.00000000.sdmp, Offset: 028B7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28b7000_gem1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: CreateProcessW$GetP$GetThreadContext$Load$ReadProcessMemory$ResumeThread$SetThreadContext$TerminateProcess$VirtualAlloc$VirtualAllocEx$WriteProcessMemory$aryA$ress
API String ID: 2687962208-232383841
Opcode ID: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction ID: a934e2b13253e7fc2fea5a08f1180bc1a0daaf132d14ac55f6a354d662d1bcd6
Opcode Fuzzy Hash: 956aea2136c6b0205ab5bf3fe1e0123e9091b05b22cf94d50ecc47fa332fbd9d
Instruction Fuzzy Hash: 19B1E67660024AAFDB60CF68CC80BDAB3A5FF88714F158118EA08EB341D774FA51CB94

Function 028B8086 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82
threadinjectionmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,028B7E7B,028B7E6B), ref: 028B80A1
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 028B80B4
Wow64GetThreadContext.KERNEL32(000000A0,00000000), ref: 028B80D2
ReadProcessMemory.KERNELBASE(0000009C,?,028B7EBF,00000004,00000000), ref: 028B80F6
VirtualAllocEx.KERNELBASE(0000009C,?,?,00003000,00000040), ref: 028B8121
WriteProcessMemory.KERNELBASE(0000009C,00000000,?,?,00000000,?), ref: 028B8179
WriteProcessMemory.KERNELBASE(0000009C,00400000,?,?,00000000,?,00000028), ref: 028B81C4
WriteProcessMemory.KERNELBASE(0000009C,?,?,00000004,00000000), ref: 028B8202
Wow64SetThreadContext.KERNEL32(000000A0,02770000), ref: 028B823E
ResumeThread.KERNELBASE(000000A0), ref: 028B824D

Strings

TerminateProcess, xrefs: 028B8130

Memory Dump Source

Source File: 00000000.00000002.1845353895.00000000028B7000.00000040.00000800.00020000.00000000.sdmp, Offset: 028B7000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_28b7000_gem1.jbxd

Similarity

API ID: Process$Memory$ThreadWrite$AllocContextVirtualWow64$CreateReadResume
String ID: TerminateProcess
API String ID: 2687962208-2873147277
Opcode ID: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction ID: ff024a46211f4c36ebca1bf851e3f51a06510563cfc6f339eeb2872bf409e524
Opcode Fuzzy Hash: 366357b1f1c2220b0d4ba716667a9fb5a6f16c59ad58adbe506062085bfa29f6
Instruction Fuzzy Hash: 68312D7624064AEBD735CF54CC91FEA73A5BFC8B15F148508EB09AF381C6B4BA018B94

Function 010927BB Relevance: 1.8, APIs: 1, Instructions: 250
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(038B3588,?,?,?), ref: 01092A91

Memory Dump Source

Source File: 00000000.00000002.1843555190.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_gem1.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 39ab32091e27151823f0258cf92552ed8becfa9a7fe0eb1c40f68033e57df107
Instruction ID: 1aa60a12db8e57aad5fcbed5f59e3e9afe86d33ade1d133f11ed8e03a0f21d97
Opcode Fuzzy Hash: 39ab32091e27151823f0258cf92552ed8becfa9a7fe0eb1c40f68033e57df107
Instruction Fuzzy Hash: AAA10871904259AFCF05CFA9D590AEDFBF1BF48314F29C659E498A7252C330A881DBA4

Function 01090668 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(038B3588,?,?,?), ref: 01092A91

Memory Dump Source

Source File: 00000000.00000002.1843555190.0000000001090000.00000040.00000800.00020000.00000000.sdmp, Offset: 01090000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1090000_gem1.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 60fb2614769ae77e0de37b66209068103072f37d5434c5ffc64a70069a272ea8
Instruction ID: d273d3c78e97fc235c44ba8b501d2d908265549a63d1d3e9c2008db63444ab49
Opcode Fuzzy Hash: 60fb2614769ae77e0de37b66209068103072f37d5434c5ffc64a70069a272ea8
Instruction Fuzzy Hash: DB21E0B5D00219AFCB10DF9AD884ADEFBB4FB49320F10812AE918B7340C374A954CBE5

Analysis Process: gem1.exePID: 7488, Parent PID: 7424COMMON

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.8%
Total number of Nodes:	1754
Total number of Limit Nodes:	84

Executed Functions

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00485F72
GetSystemMetrics.USER32(0000004D), ref: 00485F7C
GetSystemMetrics.USER32(0000004E), ref: 00485F86
GetSystemMetrics.USER32(0000004F), ref: 00485F90
GetDC.USER32(00000000), ref: 00485F9A
GetDeviceCaps.GDI32(00000000,00000008), ref: 00485FAF
GetDeviceCaps.GDI32(?,0000000A), ref: 00485FBB
CreateCompatibleDC.GDI32(?), ref: 00485FC5
CreateCompatibleBitmap.GDI32(?,00000000,00000000), ref: 00485FDA
SelectObject.GDI32(?,00000000), ref: 00485FEE
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,40CC0020), ref: 0048601D
SHCreateMemStream.SHLWAPI(00000000,00000000), ref: 0048604F
DeleteDC.GDI32(?), ref: 0048606E
ReleaseDC.USER32(00000000,?), ref: 00486077
DeleteObject.GDI32(?), ref: 00486083
IStream_Size.SHLWAPI(?,?,?), ref: 004860F5
IStream_Reset.SHLWAPI(?), ref: 00486104
IStream_Read.SHLWAPI(?,00000000,?,?), ref: 0048611E
DeleteDC.GDI32(?), ref: 00486175
ReleaseDC.USER32(00000000,?), ref: 00486183
DeleteObject.GDI32(?), ref: 0048618F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Delete$CreateMetricsObjectStream_System$CapsCompatibleDeviceRelease$BitmapCallbackDispatcherReadResetSelectSizeStreamUser
String ID:
API String ID: 2798906502-0
Opcode ID: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction ID: 1540f068b23de5c11a4fec01122546931e44dbb37a8a944e45ab45a1281bc334
Opcode Fuzzy Hash: 99dc10b740a5f021b41c68854b237c0d4245f8800150c2945631f9edaba6f951
Instruction Fuzzy Hash: F4812971C01218AFDB11EB64DC49BEDBBB8EF09314F1041AAE509B7291DB742E84CF99

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000000,00000348,00000001), ref: 00486A68
Part of subcall function 00486990: EnumDisplayDevicesW.USER32(00000000,00000001,00000348,00000001), ref: 00486ABD

Part of subcall function 004868B0: RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Part of subcall function 004863F0: GetUserNameW.ADVAPI32(?,?), ref: 00486464

Part of subcall function 004864E0: GetComputerNameW.KERNEL32(?,?), ref: 00486554

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044BAD0: Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

GlobalMemoryStatusEx.KERNEL32(?,00000003), ref: 00488A6C
GetDesktopWindow.USER32 ref: 0048936A
GetWindowRect.USER32(00000000), ref: 00489371
_strftime.LIBCMT ref: 0048956B
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,system,00000006), ref: 0048979A

Strings

ram, xrefs: 00488B55
cpu, xrefs: 0048887B
computer_name, xrefs: 00488CBE
time, xrefs: 004895E2
>wfw, xrefs: 0048920B
gpu, xrefs: 00488712
%d-%m-%Y, %H:%M:%S, xrefs: 00489560
user_name, xrefs: 004885A6
system, xrefs: 004884CA, 00488633, 0048879C, 00488905, 00488A9E, 00488BDF, 00488D48, 00488F88, 004891A9, 00489507, 00489681, 00489933, 00489A78, 00489C87
timezone, xrefs: 004899BF

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Name$Concurrency::cancel_current_taskDevicesDisplayEnumWindow$ComputerDesktopFileGlobalMemoryModuleRectStatusUserValue_strftime
String ID: %d-%m-%Y, %H:%M:%S$>wfw$computer_name$cpu$gpu$ram$system$time$timezone$user_name
API String ID: 3994675093-2215247992
Opcode ID: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction ID: 1ab1bce1cb2369babe93dc2c843a9f66333b387f055d73d8335e63cf3a34051b
Opcode Fuzzy Hash: 780eb4c071b8c58362fb5c4d0a213da67d6cb8a55b1d61346fd39ba53df65c40
Instruction Fuzzy Hash: FC037970C052A99BDB26DF28C8547DDBBB1AF19308F2482DEE44867242DB751F85CF92

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000008,00000000,14DA7ED4), ref: 0047E2A3
OpenProcessToken.ADVAPI32(00000000), ref: 0047E2AA
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),?,00000004,00000004), ref: 0047E2CE
CloseHandle.KERNEL32(00000000), ref: 0047E2F3
ExitProcess.KERNEL32 ref: 0047E32D
OpenMutexA.KERNEL32(001F0001,00000000,?), ref: 0047E411
ExitProcess.KERNEL32 ref: 0047E420
CreateMutexA.KERNEL32(00000000,00000000,?), ref: 0047E436
ExitProcess.KERNEL32 ref: 0047E457
ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Strings

SeDebugPrivilege, xrefs: 0047E337
SeImpersonatePrivilege, xrefs: 0047E341

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Process$ExitMutex$CloseHandleOpenToken$CreateCurrentInformationRelease
String ID: SeDebugPrivilege$SeImpersonatePrivilege
API String ID: 1905835197-3768118664
Opcode ID: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction ID: e600725b129d9e3f70f3f4d3925b8df88ff981f4a24a656009bcaac003b6a44b
Opcode Fuzzy Hash: 1304b057001cb0e859eaf618cd2e17930212c1f0f1b5904f04536edf5095bcb9
Instruction Fuzzy Hash: 80817F70D01258EFDB00EFE6D9457DDBBB4EF08308F10815EE51AA7281DB785A05DB69

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?,14DA7ED4), ref: 004464FE
GetProcAddress.KERNEL32(00000000,?), ref: 0044664C
GetProcAddress.KERNEL32(?,?), ref: 0044678C
GetProcAddress.KERNEL32(?,?), ref: 00446831
GetProcAddress.KERNEL32(?,?), ref: 004468D6
GetProcAddress.KERNEL32(?,?), ref: 0044697B
GetProcAddress.KERNEL32(?,?), ref: 00446A27
FreeLibrary.KERNEL32(00000000), ref: 004473A1

Strings

vault, xrefs: 00447225
!F, xrefs: 00446482
system, xrefs: 004471E6

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: system$vault$!F
API String ID: 2449869053-2452413646
Opcode ID: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction ID: b3fd50756066dde9c2bcdca3b11f87412f5b17b86e41c1a20d378922be8368ac
Opcode Fuzzy Hash: e0fea6c89a0f53085211ecf823e563bfcd2fd38e707c4234fd3e69986002ee46
Instruction Fuzzy Hash: 2CA2DFB4D0426D8BDB25CFA8C884BEEBBB1BF59304F1081DAD948B7251DB385A85CF54

Function 0046BCE0 Relevance: 19.0, Strings: 13, Instructions: 2783COMMON

Download Yara Rule

Strings

key, xrefs: 004706E0, 004707EA
content, xrefs: 0046C51D, 0046CCEC, 0046D648, 0046DF50, 0046E496, 0046E87D
`V[, xrefs: 0046F380
status, xrefs: 0046EAE9, 0046EB07, 0046EB32, 00470B25
chrome_key, xrefs: 00470925, 00470A2A
recursive_directory_iterator::operator++, xrefs: 0046EB13
directory_iterator::directory_iterator, xrefs: 00470B15
filename, xrefs: 0046C4DA, 0046CBC7, 0046D523, 0046DE37, 0046E453, 0046E83D
recursive_directory_iterator::recursive_directory_iterator, xrefs: 0046EAFC, 0046EB4A
QOP, xrefs: 0046D776
exists, xrefs: 0046EACA, 0046EADE, 0046EB27, 0046EB5E
#d5,, xrefs: 0046C1C2
3sQ, xrefs: 0046D023

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: #d5,$3sQ$QOP$`V[$chrome_key$content$directory_iterator::directory_iterator$exists$filename$key$recursive_directory_iterator::operator++$recursive_directory_iterator::recursive_directory_iterator$status
API String ID: 0-172604419
Opcode ID: 17df5ce69d1b830cbb9f37ff71955c945b1fa03de86001ee781908370b965299
Instruction ID: 6f449b873cefd2acf2ff512572e56acebc9c82323065b3056b94c270879c015f
Opcode Fuzzy Hash: 17df5ce69d1b830cbb9f37ff71955c945b1fa03de86001ee781908370b965299
Instruction Fuzzy Hash: 0C539870D01298DBDB21DBA8C9447DDBBB0AF19314F1482DEE44967292EB381F85CF96

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00485AB8
InternetOpenUrlA.WININET(00000000,?,?,00000000,84880100,00000000), ref: 00485B23
HttpQueryInfoW.WININET(00000000,00000013,?,?,00000000), ref: 00485B7C
HttpQueryInfoW.WININET(00000000,00000005,?,00000040,00000000), ref: 00485C0D
InternetQueryDataAvailable.WININET(00000000,?,00000000,00000000), ref: 00485C4F
InternetReadFile.WININET(00000000,00000000,?,0B911A77), ref: 00485CE0
InternetCloseHandle.WININET(00000000), ref: 00485DEE

Strings

dk{u, xrefs: 004858C5

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Internet$Query$HttpInfoOpen$AvailableCloseDataFileHandleRead
String ID: dk{u
API String ID: 1359475806-1025949191
Opcode ID: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction ID: 61ea4010c365d261526b7633df9a1f3866779007c1279ae13805143fd257e1b9
Opcode Fuzzy Hash: 27b0cd3a0b6fc00430f0ab845b11a26261cda9ec311c293bfde6673f79c1c1f5
Instruction Fuzzy Hash: 320203B0D057599BDB20CFA4C944BDDBBB5BF19304F20819AE848BB241EB746A84CF95

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesExW.KERNEL32(000000FF,00000000,?,00000001,?,?), ref: 004B85DD
GetLastError.KERNEL32 ref: 004B85E7
FindFirstFileW.KERNEL32(000000FF,?), ref: 004B85FE
GetLastError.KERNEL32 ref: 004B8609
FindClose.KERNEL32(00000000), ref: 004B8615
___std_fs_open_handle@16.LIBCPMT ref: 004B86CE

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFileFindLast$AttributesCloseFirst___std_fs_open_handle@16
String ID:
API String ID: 2340820627-0
Opcode ID: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction ID: b482ff722bd6c6e5562e69f300935f677b27db246a655513dfd80cbad8c50a56
Opcode Fuzzy Hash: 26e86fa6e15967cd6674ed6e37e588395ab66286ab2511015f361a3ca517eeda
Instruction Fuzzy Hash: 6271A174A01619AFCB60CF28DC84BEAB7B8BF15314F24466AE854E3380DF389D41CB65

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000028,14DA7ED4,14DA7ED4,00000000,00000000), ref: 0048CBC1
OpenProcessToken.ADVAPI32(00000000), ref: 0048CBC8
LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 0048CBDF
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000), ref: 0048CC10
CloseHandle.KERNEL32(00000000), ref: 0048CC2E

Strings

SeDebugPrivilege, xrefs: 0048CBD9

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID: SeDebugPrivilege
API String ID: 3038321057-2896544425
Opcode ID: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction ID: c2b5bf8999928723eaabf61e86e1a0babf1022b92d12b441156265fc3f808218
Opcode Fuzzy Hash: 0de4daaceb39ec4f5814627b6f1dd40d7c5fb6c13739ccbd22e93afb17c114b7
Instruction Fuzzy Hash: 4631A471D01208AFDB10DFA5DD85BEEBBB8EB09710F14422BE911B7280DB745A44CBB5

Function 004422D0 Relevance: 10.4, Strings: 7, Instructions: 1667COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 00443EA5, 00443ECC
filename, xrefs: 00442AC9, 004430A3, 00443BED
content, xrefs: 00442C08, 004431CF, 00443CA9
users, xrefs: 004436FB
status, xrefs: 00443EDC
exists, xrefs: 00443EB5, 00443EEC
config, xrefs: 00442DB6

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task$___std_fs_directory_iterator_advance@8
String ID: config$content$directory_iterator::directory_iterator$exists$filename$status$users
API String ID: 1444412035-815903332
Opcode ID: 318ca2c7c1d0ec5466f5f7fa8089217a923a2ba81121507c44c59a0bacf04028
Instruction ID: 69ad5e660c85d4a4c183ac21095e054d7cf3219f32a2a219316693d81515d842
Opcode Fuzzy Hash: 318ca2c7c1d0ec5466f5f7fa8089217a923a2ba81121507c44c59a0bacf04028
Instruction Fuzzy Hash: 83036670C012A8DBEB25DF68C9447EDBBB0BF19308F1481DAE44967242DB785B89CF95

Function 004473D0 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 301processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,14DA7ED4), ref: 0044741C
Process32FirstW.KERNEL32(00000000,?), ref: 00447468
Process32NextW.KERNEL32(?,0000022C), ref: 004475CD
CloseHandle.KERNEL32(?), ref: 004478D2

Strings

[PID: , xrefs: 004474B1

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: [PID:
API String ID: 420147892-2210602247
Opcode ID: f6cb1e4388cc3ee2ddfe8d86821b50136ea940ed39218dba736c248fcd380ac9
Instruction ID: 3632983ffbfa210010dfb9a713b5006bf5dbac80d679a8e5b8b4f374b17b9b69
Opcode Fuzzy Hash: f6cb1e4388cc3ee2ddfe8d86821b50136ea940ed39218dba736c248fcd380ac9
Instruction Fuzzy Hash: 0AE14770D112689BDB2ADF24CC807AEBBB9BF59304F1481D9E84867251DB346F89CF45

Function 00470EF0 Relevance: 8.2, Strings: 6, Instructions: 690COMMON

Download Yara Rule

Strings

filename, xrefs: 004719B8
prefs.js, xrefs: 00472363, 0047237A
Te=J, xrefs: 004724F1
4So, xrefs: 00472161
;r0', xrefs: 00472481
exists, xrefs: 00470ED5, 00472E56

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: ;r0'$Te=J$exists$filename$prefs.js$4So
API String ID: 0-741858243
Opcode ID: 11664829bde5b78b5a453b90576b65e8c9c4f4be2f2613c5aa62205ba5478c4c
Instruction ID: 8485e3fbea9921b25a1b00865498cb3d77a8dac2e86307723f5e7c2a487e452b
Opcode Fuzzy Hash: 11664829bde5b78b5a453b90576b65e8c9c4f4be2f2613c5aa62205ba5478c4c
Instruction Fuzzy Hash: F182EFB0D052689FDB65CF68C985BDDBBB0AF19304F1082EAE84CA7251EB341B85CF55

Function 0043E4F0 Relevance: 7.5, Strings: 5, Instructions: 1249COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0043FA92
filename, xrefs: 0043ED01, 0043F2D8, 0043F71D
content, xrefs: 0043EE5E, 0043F460, 0043F8A2
status, xrefs: 0043FA76, 0043FA82
exists, xrefs: 0043FA4C, 0043FA60, 0043FA9F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_fs_convert_wide_to_narrow@20
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 2353561611-3429737954
Opcode ID: 7405bf85bba606f5aa6e5f11bda1af194d4c4d3f657d06d7efc73589d2298c94
Instruction ID: 45a97de4b3c177a88e72af5189b64a28b2304548a2ed9d28553215762f3f74ee
Opcode Fuzzy Hash: 7405bf85bba606f5aa6e5f11bda1af194d4c4d3f657d06d7efc73589d2298c94
Instruction Fuzzy Hash: DBD24770D05268DBDB22DF68C8547DDBBB0AF19304F1482DAE44867282DB785F89CF95

Function 004402D0 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 333fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,?), ref: 004403C0
FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Strings

filename, xrefs: 004405E4
content, xrefs: 0044063C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: content$filename
API String ID: 1690352074-474635906
Opcode ID: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction ID: 3fd07a7a2c97014430c74f1e6d5836f1a3ad12268408335d8deab24a75892f91
Opcode Fuzzy Hash: 3df7f202a6b99253f354de22ded639a46978a58fefe962044121c03344fab8ef
Instruction Fuzzy Hash: 2BD1D430D01249DBEB15EB64CD457EEBBB4AF21308F1440AEE505A7292DB785F48CB96

Function 0043C970 Relevance: 6.9, Strings: 5, Instructions: 699COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0043D484
filename, xrefs: 0043D0F6
content, xrefs: 0043D260
status, xrefs: 0043D48F
exists, xrefs: 0043D470

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: content$directory_iterator::directory_iterator$exists$filename$status
API String ID: 0-3429737954
Opcode ID: 0f0324d2262f6727271b1798928450f2e50f2587d7e5877d9cda94f309b22af2
Instruction ID: 4f0253fa2b569f3355fb29b5c5a77bd21c490a3de55638da9b673f05fe568e9e
Opcode Fuzzy Hash: 0f0324d2262f6727271b1798928450f2e50f2587d7e5877d9cda94f309b22af2
Instruction Fuzzy Hash: 137234B0D05268CBDB25CFA8C8817EEBBB1BF19304F14819AD849B7341DB785A85CF95

Function 00459A06 Relevance: 6.8, Strings: 5, Instructions: 541COMMON

Download Yara Rule

Strings

object, xrefs: 0045A06C
object key, xrefs: 00459E92, 0045A1C4
array, xrefs: 00459FC0
object separator, xrefs: 00459DE0, 0045A118
R, xrefs: 0045A25B

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: R$array$object$object key$object separator
API String ID: 0-4025529536
Opcode ID: c2ea74c46638cb6805419194197d9cd192a644bc36a2140f7da50fef402dd0ab
Instruction ID: a821d995b12610201d621210502fbeceba3941e2954cbb2726e101dc0738d9ca
Opcode Fuzzy Hash: c2ea74c46638cb6805419194197d9cd192a644bc36a2140f7da50fef402dd0ab
Instruction Fuzzy Hash: C322CB70D0035CDFDB14DBA8C855BEEBBB4AF15305F10455EE806A7282EB786A4CCB95

Function 00485350 Relevance: 6.3, APIs: 4, Instructions: 316networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00002000,00000000), ref: 004854A4
recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(0000026C), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: recv$Cleanupclosesocket
String ID:
API String ID: 146070474-0
Opcode ID: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction ID: ea48c0c3f42896101b1dfecbe024c21eb3956ad5c3a4809403442742827d540a
Opcode Fuzzy Hash: 9e36abc3380925dd93690334c8facdcdb208839f31d4ee637cc8ac082e786f44
Instruction Fuzzy Hash: 4CE19C70D01298DEDB14EB64CC49BDEBBB2BF14308F1041DAE449AB292DB745E88DF95

Function 00487780 Relevance: 5.8, APIs: 1, Strings: 2, Instructions: 515timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,14DA7ED4,00000000,000000BF), ref: 00487C87

Strings

[UTC, xrefs: 00487C45
@Zb=, xrefs: 00487A4F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: @Zb=$[UTC
API String ID: 565725191-730387550
Opcode ID: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction ID: 6d71337f0f8cf227c7c56c381cd8fae4285dcd83216f0cb77706b7edbf0b928b
Opcode Fuzzy Hash: cf8fb0669151e3915c1c56c918cda204041e77f9a4f9e4b93b5b3df9b86f4cc7
Instruction Fuzzy Hash: E0520270D052688BDB25CF28CC947DDBBB1BF59304F1082DAD949AB281DB756B85CF84

Function 0043BF70 Relevance: 5.6, Strings: 4, Instructions: 612COMMON

Download Yara Rule

Strings

directory_iterator::directory_iterator, xrefs: 0043C95F
filename, xrefs: 0043C5CC
content, xrefs: 0043C73C
exists, xrefs: 0043C948

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: content$directory_iterator::directory_iterator$exists$filename
API String ID: 118556049-1400943384
Opcode ID: f5691b255ea6dbc5edbd5c9a2dd3daa32d7e1fdddb1a19eceb15310520a34560
Instruction ID: f0d25c64484c1e08d98ca61568cc243e7f3e3728f1e912629745c9d05fd4e174
Opcode Fuzzy Hash: f5691b255ea6dbc5edbd5c9a2dd3daa32d7e1fdddb1a19eceb15310520a34560
Instruction Fuzzy Hash: F26234B0D01268CBDB25DFA8C9817EDBBB0BF19304F14829AD84977342DB785A85CF95

Function 004A1074 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0049C0BD: RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
Part of subcall function 0049C0BD: GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Summer Time, xrefs: 004A1193
Eastern Standard Time, xrefs: 004A117F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 3335090040-239921721
Opcode ID: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction ID: 53762b2ebd1cb462dfa51e434dc7c6f7f2cc61e8d19f93444a713380c049c16d
Opcode Fuzzy Hash: ad663869331fc52042eea7bfe790139a2e80b582501180bae3c234ee24cd9100
Instruction Fuzzy Hash: 73410871C00224ABDB10AF76DC45A9F7BB8EF6A754F10415BF510EB2A1E7349D04DB98

Function 004B84C0 Relevance: 4.5, APIs: 3, Instructions: 35COMMONLIBRARYCODE

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,14DA7ED4,00000001), ref: 004B84CC
FindFirstFileExW.KERNEL32(000000FF,00000001,14DA7ED4,00000000,00000000,00000000,00000001,00000001,?,?,004B84EE,00000001,?,?,00437D69,?), ref: 004B84FB
GetLastError.KERNEL32(?,004B84EE,00000001,?,?,00437D69,?,004BDC4D,00000001,?,?,?,14DA7ED4,00000001), ref: 004B850D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction ID: a5a0d7868366c0cca89b591e166bcddb9b03d08ebbd2c2fb18ba3c3c76c3338f
Opcode Fuzzy Hash: 6891505d0e316c560b8af891ce29886cce9dd01a211028f8c8b4780eaf2fe176
Instruction Fuzzy Hash: 0AF03071001109BFDB216FA4EC08AAA7B9DEB14360B10862ABD28C55A0EA359961DB79

Function 004479C0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 647COMMON

Download Yara Rule

APIs

Part of subcall function 00487290: RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,14DA7ED4,?,0051C288), ref: 0048735B
Part of subcall function 00487290: RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,14DA7ED4,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004487A3

Part of subcall function 004870B0: RegCloseKey.ADVAPI32(00000000), ref: 00487260

Strings

0hC, xrefs: 00448799

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Open$CloseEnumIos_base_dtorQueryValuestd::ios_base::_
String ID: 0hC
API String ID: 3553622603-2581318919
Opcode ID: 0bcb193991c17a35e04031cec61f2fc9a228979a7f5d57045d0cffd32dde56ff
Instruction ID: d381e0b8d15ce89c3a027b92e8a5ae116750b180a2e65f5cba22683de7249f8f
Opcode Fuzzy Hash: 0bcb193991c17a35e04031cec61f2fc9a228979a7f5d57045d0cffd32dde56ff
Instruction Fuzzy Hash: EA82CEB4E152688FEB25CF18C8957DDBBB0BF5A304F5082DAD98DA7241DB305A85CF81

Function 0047A610 Relevance: 3.1, APIs: 2, Instructions: 119encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction ID: 0fc5e8941a16b16f9458543aa06cdc6e77fe0ca1878954e15eaf8ff6be4b297f
Opcode Fuzzy Hash: 23f8f3dfd76d3946956684746ccb5c99c2b1de592e134c678ee3552ffd4f36d7
Instruction Fuzzy Hash: 86518B70C00249EBEB00DFA5D845BDEFBB4FF54708F14821AE81477281D7B96A98CBA5

Function 0046EB70 Relevance: 2.3, Strings: 1, Instructions: 1019COMMON

Download Yara Rule

Strings

i`[, xrefs: 0046FECB

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: i`[
API String ID: 0-627998571
Opcode ID: e3a410a9e3ca53c342af7cc7fde5a733c932cb315480ea9a7238ac1123cd91a2
Instruction ID: f409668d1dcd92952583ea64716c6161a23bbeab54c2797513d5a6ff86e8a7fe
Opcode Fuzzy Hash: e3a410a9e3ca53c342af7cc7fde5a733c932cb315480ea9a7238ac1123cd91a2
Instruction Fuzzy Hash: 68D29DB4D0436C8ADB25CF99D8957DCFBB2BF49304F00819AD959AB345EB341A8ACF44

Function 00487550 Relevance: 1.6, APIs: 1, Instructions: 133COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNEL32(00000104,?,14DA7ED4), ref: 00487605

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction ID: 0be71067b94349f3b163f10fc7865c9901b3f86c171c2f757c76e38bbf7f7ec5
Opcode Fuzzy Hash: af7986355f76353f56621d05ed0878166b8efb0a331a21fa16df84ccda1fe4cc
Instruction Fuzzy Hash: 3351BD70C05318DBDB20DF64D85979EB7B0EF18304F1082DED409A7291EBB86A88CB95

Function 004863F0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00486464

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction ID: 991b9e5c4f1dd7985d860474454b41f109cd49006b683c09ab2e27c6457cb47f
Opcode Fuzzy Hash: f4ed9f5e37941df1e9ba9867385f1ec3f0cb7986d12087e88cefc21d8231c34a
Instruction Fuzzy Hash: AF217FB0D043189BD721DF15C844B9ABBF4FB08714F0046AEE84997380DBB9A6849BE5

Function 00486C50 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

cores, xrefs: 00486E4E

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: cores
API String ID: 0-2370456839
Opcode ID: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction ID: e3a9e89045bf121aadbf864e887aeb25ba0c58f762de233e8adf5c73134b1a6d
Opcode Fuzzy Hash: 7caecc748150b05fedb2737b290fa2d10d67063e027dfbdfaad7aac65fe8cbf0
Instruction Fuzzy Hash: 2B916871D003599BDB00CFA8C9547EEFBB4FF59304F14825AE404BB292EBB56A84CB91

Function 0043A2B0 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02a584f50cec7d117239a346da7015494028620e642b4639fe7f05473c013932
Instruction ID: a79bf28788cd7fece911b6e1e66e8534556c7722a2d9226744d1a7d19b7185e3
Opcode Fuzzy Hash: 02a584f50cec7d117239a346da7015494028620e642b4639fe7f05473c013932
Instruction Fuzzy Hash: 89F197B4D053588BDB25CFA8CA91BDDBBB0AF4A314F20419AD84DBB351DB306A85CF44

Function 00439D60 Relevance: .3, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 186fcadbebabc4ac8475eff220d5f03fe57b16df31032e8b523138032ae08221
Instruction ID: 4fd346efeb900e22f944567b89219bf35164593af445f665e6b4c60aa2d00baf
Opcode Fuzzy Hash: 186fcadbebabc4ac8475eff220d5f03fe57b16df31032e8b523138032ae08221
Instruction Fuzzy Hash: 76F187B4D053588BDB25CFA8CA91BDDBBB0BF5A304F20419AD84DAB351DB306A85CF44

Function 004395D0 Relevance: .3, Instructions: 292COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee95dc0e5b5396d58bf0237a5e01a6f13710f7daf9d7380e93e4a8007b91f328
Instruction ID: 7cc2350b8a4e2648267175039a6658fe4e1c6b2b5322fe7f087af9f211071a42
Opcode Fuzzy Hash: ee95dc0e5b5396d58bf0237a5e01a6f13710f7daf9d7380e93e4a8007b91f328
Instruction Fuzzy Hash: 0CF187B4D053588BDB25CFA8CA91BDDBBB0BF4A304F20419AD84DAB351DB306A85CF44

Function 00480C80 Relevance: 19.8, APIs: 13, Instructions: 258
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004808F0: InitializeCriticalSectionEx.KERNEL32(0051C7AC,00000000,00000000), ref: 0048096F
Part of subcall function 004808F0: GetLastError.KERNEL32 ref: 00480979

EnterCriticalSection.KERNEL32(00000004,14DA7ED4,?,?), ref: 00480CD8
GdiplusStartup.GDIPLUS(00000000,00000001,?), ref: 00480D08
LeaveCriticalSection.KERNEL32(00000004), ref: 00480D13
LeaveCriticalSection.KERNEL32(00000004,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00480D42
GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 00480D50
__alloca_probe_16.LIBCMT ref: 00480D7E
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00480DCE
GdipCreateBitmapFromScan0.GDIPLUS(?,?,?,0026200A,?,?), ref: 00480EB3
GdipSaveImageToStream.GDIPLUS(00000000,?,?,00000000), ref: 00480ED0
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F33
GdipDisposeImage.GDIPLUS(00000000), ref: 00480F4C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Gdip$Image$CriticalSection$DisposeEncodersLeave$BitmapCreateEnterErrorFromGdiplusInitializeLastSaveScan0SizeStartupStream__alloca_probe_16
String ID:
API String ID: 1308617310-0
Opcode ID: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction ID: f4feccb951fe1b922ecb3dfaf5b8302156747445c0b76c240fb24b0f4f51c94e
Opcode Fuzzy Hash: db8e19989c3c8e354b887b54b5669c89f7a5afa25811b29cf81357a5f4059125
Instruction Fuzzy Hash: D1A165B1D10208DFDB50DFA4C984BAEBBF4FF49314F24452AE905A7340D778A949CBA9

Function 00481B10 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 293
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00485E30: GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
Part of subcall function 00485E30: GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

WSAStartup.WS2_32(00000202,00516D04), ref: 00481C85
socket.WS2_32(00000002,00000001,00000000), ref: 00481C98
htons.WS2_32(00000002), ref: 00481CBF
inet_pton.WS2_32(00000002,00000000,00516E98), ref: 00481DA2
connect.WS2_32(00516E94,00000010), ref: 00481DB5
closesocket.WS2_32 ref: 00481DD5
WSACleanup.WS2_32 ref: 00481DDB

Strings

NG, xrefs: 00481B1D
geo, xrefs: 00481C1D
system, xrefs: 00481B74

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Info$CleanupStartupUserclosesocketconnecthtonsinet_ptonsocket
String ID: NG$geo$system
API String ID: 213021568-968879199
Opcode ID: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction ID: a79096e42c26a1a604384fcb43a931ed9af1c00745f33276f8ffcea807cfd111
Opcode Fuzzy Hash: 3e51a562f8bb916ff5cdbc648a8933530491576e42c442edfc0125d67360bed5
Instruction Fuzzy Hash: 1DC1AE70D01248DBDB00EFA8C8457DEBBB5FF15308F14421BE854AB391EBB86A85CB95

Function 004BC57A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004BC233: CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

GetLastError.KERNEL32 ref: 004BC68E
__dosmaperr.LIBCMT ref: 004BC695
GetFileType.KERNEL32(00000000), ref: 004BC6A1
GetLastError.KERNEL32 ref: 004BC6AB
__dosmaperr.LIBCMT ref: 004BC6B4
CloseHandle.KERNEL32(00000000), ref: 004BC6D4
CloseHandle.KERNEL32(004BB653), ref: 004BC821
GetLastError.KERNEL32 ref: 004BC853
__dosmaperr.LIBCMT ref: 004BC85A

Strings

H, xrefs: 004BC7DF

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction ID: e4caf95108e2d56c13f9780512823c5111e6df0be3dd416bceb2684eca6e9c1f
Opcode Fuzzy Hash: 1092716943437c36cfa02252dfbb3b8d28f6a4b1d2fea1c18a37bf8b19ebdc4d
Instruction Fuzzy Hash: 65A13632A041549FCF19AF68DCD1BEE3BA1AB46314F14015FF8119F391CB798906CBA9

Function 00481110 Relevance: 11.0, APIs: 4, Strings: 2, Instructions: 526
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004812EC
GetFileSize.KERNEL32(00000000,00000000,?,?,00000000,000000B8), ref: 004812FC
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00481388
ReadFile.KERNEL32(00000000,00000000,00516C10,00000000,00000000), ref: 004813A4

Strings

0hC, xrefs: 004812E2
exists, xrefs: 0048181F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: File$Ios_base_dtorPointerReadSizestd::ios_base::_
String ID: 0hC$exists
API String ID: 418202444-4085241440
Opcode ID: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction ID: 03b619e30c80654d4b10cf1501dd509fce63877f60a48615618d7203a258c35b
Opcode Fuzzy Hash: 484f58a7a18a46d98bb1edb3502d40a625e7069bcaa41c24cad3f5034e0e3b9d
Instruction Fuzzy Hash: 3E425D70D01248DFDB10DFA9C9447DDBBF4BF19308F10819AE849A7291DB746A89CF95

Function 00453280 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___std_exception_destroy.LIBVCRUNTIME ref: 00453446
___std_exception_destroy.LIBVCRUNTIME ref: 00453463

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,14DA7ED4), ref: 004AFA6C

___std_exception_destroy.LIBVCRUNTIME ref: 004536B0
___std_exception_destroy.LIBVCRUNTIME ref: 004536CD

Strings

MC, xrefs: 0045343C, 00453458, 004536A6, 004536C2
value, xrefs: 00453386, 004535E5

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_exception_destroy$ExceptionRaise
String ID: MC$value
API String ID: 299339551-3840657116
Opcode ID: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction ID: 0b049260404a019bd3923239173dd3b15bf9369a861e2bc94eedd162a5d5976f
Opcode Fuzzy Hash: 105946c5cbd8b82caa2ff389fd77db40c33b1abb7ad3302a948b5beaa238df8e
Instruction Fuzzy Hash: 1EF16B70C05298DEEB20DB65C954BDEFBB4AF19304F1481DED84963282E7746B88CF96

Function 0049EF0E Relevance: 9.3, APIs: 6, Instructions: 292
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccfc0c2450c919e5ca8e87a3f3fa153f15bbe28b91ce2660b0eab54348b933ba
Instruction ID: af9c87e70908a1ee06dfbc346dd9d7a470d4d3b04964572cafa80a59c2292356
Opcode Fuzzy Hash: ccfc0c2450c919e5ca8e87a3f3fa153f15bbe28b91ce2660b0eab54348b933ba
Instruction Fuzzy Hash: ACB13274A04249EFEF11CF99C841BAE7FB1AF46304F14417AE5009B392C7B99D4ACB99

Function 0049865A Relevance: 9.3, APIs: 6, Instructions: 265
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__allrem.LIBCMT ref: 004987E2
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 004987FE
__allrem.LIBCMT ref: 00498815
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498833
__allrem.LIBCMT ref: 0049884A
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00498868

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction ID: bac2f8d64b4771d1480d5067db4f3a3676e567bfb19d99c183f063f20f68270c
Opcode Fuzzy Hash: 0bad0c18fe0cf381acad9996688c966a33eada49a23c210a765f4fa7ac2e53a6
Instruction Fuzzy Hash: A68107B26007069BDB20EA6DCC41B5B7BE9AF52364F24453FF111DB791EB78D9008B98

Function 004823F0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 280COMMON

Download Yara Rule

Strings

0hC, xrefs: 00482852
exists, xrefs: 0048291E
0, xrefs: 004827FE

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0$0hC$exists
API String ID: 323602529-1229763112
Opcode ID: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction ID: 8ad686ceee80f5ac92384c61aa111afe13dce58c6585d204e44adfbc4e8d440e
Opcode Fuzzy Hash: f10948b3ed40f3b076f8b225239c75273635f3694046d4e0320974136430c3f1
Instruction Fuzzy Hash: 81D18070D0528CDAEB10DBA8CA45BDCBBF4AF19308F2440DDE4456B282DBB95F48DB56

Function 004865D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 230registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0047FD70: ___std_fs_get_current_path@8.LIBCPMT ref: 0047FE92

GetVolumeInformationW.KERNEL32(?,?,00000100,?,?,?,?,00000100,00000000,?,14DA7ED4,?,?), ref: 00486757
RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

ProductName, xrefs: 00486900
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InformationValueVolume___std_fs_get_current_path@8
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 2814272438-1787575317
Opcode ID: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction ID: 5513a57b40c567382305f19abecc614c7fb65df7785b10e0462d816fc7d7abf5
Opcode Fuzzy Hash: b1404d09f7114e8511fbbac145fb6ec7f4eb5f2e1f33eee02c53c21e1c4c82cd
Instruction Fuzzy Hash: DFA18BB1C012199BDB21DF55CD59BE9B7B4FF14304F1042EAE419A7281EB786B88CF94

Function 0048A490 Relevance: 6.2, APIs: 4, Instructions: 195COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(14DA7ED4), ref: 0048A4E4
FreeEnvironmentStringsW.KERNEL32(?), ref: 0048A685
RtlInitUnicodeString.NTDLL(?), ref: 0048A6D9
RtlInitUnicodeString.NTDLL(?,00000000), ref: 0048A6E4

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EnvironmentInitStringStringsUnicode$Free
String ID:
API String ID: 2488768755-0
Opcode ID: 087de5e6dd1055750bf7132ea8417913862878fff25edd8fa91e2b0393d86743
Instruction ID: 1a99e4392def1b605416f46e3147960cb17592dd8275db88d5f878599104deaf
Opcode Fuzzy Hash: 087de5e6dd1055750bf7132ea8417913862878fff25edd8fa91e2b0393d86743
Instruction Fuzzy Hash: 6471AAB1C10219EBDB00DF98C884B9EFBF8FF18304F14461BE815A3250E7B8A995CB95

Function 004A0DE2 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004A1227,00000000,00000000,00000000), ref: 004A10E6

Strings

Eastern Summer Time, xrefs: 004A1193
Eastern Standard Time, xrefs: 004A117F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InformationTimeZone
String ID: Eastern Standard Time$Eastern Summer Time
API String ID: 565725191-239921721
Opcode ID: f479341c917e5b85ea8d4f872af5b2a7ed3f0ffe6aef50257419f0e8574b0954
Instruction ID: d63cae11faca7fbaaedfd5ec0c01f193a5a5e64d1a9f5e85edff99bc4745f09f
Opcode Fuzzy Hash: f479341c917e5b85ea8d4f872af5b2a7ed3f0ffe6aef50257419f0e8574b0954
Instruction Fuzzy Hash: D5C15872D00211ABDB20AB65CC02ABF7BB9EF76754F10405BF901EB291E7788E41D798

Function 00481F10 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D726
Part of subcall function 0045D680: ___std_fs_convert_narrow_to_wide@20.LIBCPMT ref: 0045D750

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00482387

Part of subcall function 0043E440: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0043E4CF

Strings

0hC, xrefs: 0048237C
exists, xrefs: 004823DA

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtor___std_fs_convert_narrow_to_wide@20std::ios_base::_
String ID: 0hC$exists
API String ID: 1525435645-4085241440
Opcode ID: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction ID: 349907f898d0770bf1c6c6bee16b757a414fbaa0545e2b95a55e182eb82389be
Opcode Fuzzy Hash: 8ca7fd5849306998ec001e4bdecb4b4743a0745ed80b2030e0a7e1d66a3192b0
Instruction Fuzzy Hash: 1ED19F70D0528CDAEB10DBA8CA45BDCBBF0AF19308F2480DDD4456B282D7B95F58DB56

Function 00438180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 004381BC

Part of subcall function 004B849F: FindNextFileW.KERNELBASE(?,00000001,?,00437D97,?,00000001,?,004BDC4D,00000001,?,?,?,14DA7ED4,00000001), ref: 004B84A8

Strings

., xrefs: 004381CE
directory_iterator::operator++, xrefs: 00438294

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID: .$directory_iterator::operator++
API String ID: 3878998205-1036657373
Opcode ID: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction ID: 735a56af49808cf236c7d8626bd4983a1e4e1118483563b87a501f55d85a1d57
Opcode Fuzzy Hash: 42ea8ddbda2b7e0b12b5802c67e6a5f09428df7f782a6b2438fae6bd72fb2b67
Instruction Fuzzy Hash: C7318D70A047188BCF30DF59C8887ABF7B4EB49310F14429EE45997391DB395E85CA84

Function 004868B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegGetValueA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,ProductName,00000002,00000000,?,?), ref: 00486916

Strings

ProductName, xrefs: 00486900
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00486905

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Value
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3702945584-1787575317
Opcode ID: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction ID: c2d08890748770af0873008191db5a05c2fa34d27609d4939fc155a72502f57e
Opcode Fuzzy Hash: b1b14b774ef6c570b057e3b558ffe0deac3071ed0933685e6c950abb9736e9bf
Instruction Fuzzy Hash: 95218EB09003599BDB20DF54C805BEABBF8FF04704F10465EE845A7681DBB86A44CB95

Function 00487290 Relevance: 4.7, APIs: 3, Instructions: 178registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0047F265,00000000,00020019,00000000,14DA7ED4,?,0051C288), ref: 0048735B
RegEnumKeyExA.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00487397
RegCloseKey.ADVAPI32(00000000), ref: 0048751D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseEnumOpen
String ID:
API String ID: 1332880857-0
Opcode ID: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction ID: e90b3dd054a924dd9803ab5f17a38fc1c4cefb0d6438d00707aa441ccba3a8d8
Opcode Fuzzy Hash: 583436978cce415da765378ea93a3ed95bf41f57cd7b16fc1002d349e714ed29
Instruction Fuzzy Hash: E3717FF0D012189FDB20DF24CD94B9DB7B4EB54304F1082DAEA19A7281D774AE88CF99

Function 004870B0 Relevance: 4.6, APIs: 3, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,14DA7ED4,0051C570,0051C2A0), ref: 00487182
RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6
RegCloseKey.ADVAPI32(00000000), ref: 00487260

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction ID: b9c4edd99e38da91ddb4c738108b0054469e00b62f6e0a688ac56e9026d709b2
Opcode Fuzzy Hash: 57d060fa11377f52f079fc837384727404e649e1529402bdcb096a3e64267e6d
Instruction Fuzzy Hash: 905130B0D042189BDB20DF15CD54B9AB7F8FF45708F5042DEE609A7281DB74AA88CF99

Function 004855F0 Relevance: 4.6, APIs: 3, Instructions: 99networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,00000001,00000000), ref: 004857E2
closesocket.WS2_32(0000026C), ref: 004857EE
WSACleanup.WS2_32 ref: 004857F4

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketrecv
String ID:
API String ID: 3447645871-0
Opcode ID: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction ID: c065b03366e761df0b34e2ad76ec595a4b6e3bb6db0e63c2aea2bbb819f94b56
Opcode Fuzzy Hash: a55422f294b4942afa1ff90dfbe741e21dd202ebe771de9cafeea328bec9a277
Instruction Fuzzy Hash: 6C415830D11398CEEB14EB65CC59BDEBB71AF10308F1081DAE449672A2DB741E88DFA5

Function 00485E30 Relevance: 4.6, APIs: 3, Instructions: 65COMMON

Download Yara Rule

APIs

GetUserGeoID.KERNEL32(00000010), ref: 00485E6C
GetGeoInfoA.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00485E7E
GetGeoInfoA.KERNEL32(0000000F,00000004,?,00000000,00000000), ref: 00485ED6

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Info$User
String ID:
API String ID: 2017065092-0
Opcode ID: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction ID: dee3d2b381a88aa75edb4726eebd2668ef991be1adfc48943d59dd3409b8a73b
Opcode Fuzzy Hash: 76db3dc4c87bbc6f384a5473c1c7e0f0467f6834ab8a05054a61e1c1351183cd
Instruction Fuzzy Hash: 60219D70A40305ABE730DF65DD09B5BBBF8EB44B14F104A1EF545AB6C0D7B9AA048BE4

Function 004A2897 Relevance: 4.5, APIs: 3, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,004A2891,00000016,0049036B,?,?,14DA7ED4,0049036B,?), ref: 004A28A8
TerminateProcess.KERNEL32(00000000,?,004A2891,00000016,0049036B,?,?,14DA7ED4,0049036B,?), ref: 004A28AF
ExitProcess.KERNEL32 ref: 004A28C1

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction ID: 5f52cdf8944b70cf92df4f225d6e01553ce615c3954620652ef0a1f31c52b3c3
Opcode Fuzzy Hash: c52b8aea0878e361db6f998eabd52a91712daacfbdb63a7d2bb12d779e64a9bf
Instruction Fuzzy Hash: ACD09E71001108BBDF423F65ED0DB8E3F2AEF55745F044026B9095A131DB799995EB98

Function 004487D0 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

Part of subcall function 0048A490: GetEnvironmentStringsW.KERNEL32(14DA7ED4), ref: 0048A4E4

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00448C83

Strings

0hC, xrefs: 00448C7C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EnvironmentIos_base_dtorStringsstd::ios_base::_
String ID: 0hC
API String ID: 21748421-2581318919
Opcode ID: 32cf3fd00b256853298aeee19d6a53faff9ad05029ab8b651d4d6efafff1f4c4
Instruction ID: f3a074da2f4c09c6f09d17eaf24c6677e7622b6743d10a431c53a42b2b0ae44f
Opcode Fuzzy Hash: 32cf3fd00b256853298aeee19d6a53faff9ad05029ab8b651d4d6efafff1f4c4
Instruction Fuzzy Hash: 9DE137B0D00269CBDB25DF18C841BDDBBB4BF59304F1086EAD44977242EB756A85CF91

Function 0047EE90 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

Part of subcall function 0047F1C0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,14DA7ED4), ref: 0047F211
Part of subcall function 0047F1C0: RegCloseKey.ADVAPI32(00000000), ref: 0047F221

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047F194

Strings

0hC, xrefs: 0047F18D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseIos_base_dtorOpenstd::ios_base::_
String ID: 0hC
API String ID: 1131316584-2581318919
Opcode ID: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction ID: cfb713b882ce29762410958d43b6c09695d359a02ab63b143eff75d03a191730
Opcode Fuzzy Hash: 7cba46937cda891c258594ace6fbaf3fef31f328805038bc20a4f0a0119cf12a
Instruction Fuzzy Hash: 59911674C00298CBDB20DF68C845BDDBBB0AB19314F1086EAD45977282DB746E88CF95

Function 00486F20 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetCurrentHwProfileW.ADVAPI32(?), ref: 00486F86

Strings

Unknown, xrefs: 0048705A

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CurrentProfile
String ID: Unknown
API String ID: 2104809126-1654365787
Opcode ID: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction ID: 4cfd0b05124d6ad0cc2ed0fe670d1554fe3cca3eb32f1e14fa8b394e0e179909
Opcode Fuzzy Hash: d6032fd6981b0caf5e4c49708838f9cebd9397818ef9a0e4cf965eded2abff42
Instruction Fuzzy Hash: 74418B71D00258CBDB20DF69C8407DEFBF4EF49704F1082AAD899A7281D774AA88CF91

Function 004ABC08 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 85COMMONLIBRARYCODE

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Strings

MC, xrefs: 00434FDC

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: MC
API String ID: 2659868963-1829682832
Opcode ID: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction ID: 040724f085c67d798f1d490f9b73413860191a50a7d7deb79defe6124e27c29a
Opcode Fuzzy Hash: a7a485d9c83800eb579eb1fbe217d44add95b41717c89af58e444174cff24a24
Instruction Fuzzy Hash: 3611EB71800308ABCB10DF58DC01B9AB7ACEB15724F10466FF81597780EB79A940CBD8

Function 00447920 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0044799C

Strings

0hC, xrefs: 00447996

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Ios_base_dtorstd::ios_base::_
String ID: 0hC
API String ID: 323602529-2581318919
Opcode ID: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction ID: 8ca8b340eaa0dfe9bad33bee777e0704730a4b63aab2394a13b70ad755bbc225
Opcode Fuzzy Hash: 5129ab555f51bed53336c49a6076550c51d3d5e874f0d443237048deba2c8ea9
Instruction Fuzzy Hash: CD11ADB0840609DFDB10DF59C840A9DFBF8FB05328F208A6EE85197390EB74AA05CB80

Function 00437CB0 Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00437D64
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00437D92

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 3016148460-0
Opcode ID: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction ID: c774fac7b26238caf8a18ea1cc9dfb162d547f418ec2e445b27f5ef4f4107e88
Opcode Fuzzy Hash: 73963d7e42f46bada0bb91468d8e6c86860c6526e71e689b58131c2916953d37
Instruction Fuzzy Hash: E841A0B1D04218DBCB34DF64C480AEEB7B4EF19324F00516BE851AB381EB789D44CB94

Function 00480F90 Relevance: 3.1, APIs: 2, Instructions: 108COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(004E05C0,00000000,00000000,?,14DA7ED4,?,?), ref: 0048101E
CoTaskMemFree.OLE32(?), ref: 004810DC

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FolderFreeKnownPathTask
String ID:
API String ID: 969438705-0
Opcode ID: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction ID: 3e538bd659216d3e4857fbb8bc962106784e19cd0647cea7878622876b38b54a
Opcode Fuzzy Hash: 72aa8b02f906d3fbe3ba85b36074818c76339de4eced8fbcc3b8c7e13541c268
Instruction Fuzzy Hash: 4241ACB0D01748DBDB10CFA5C9457AEFBF4EF58314F20421EE811A7280EBB86A44CB94

Function 0047F1C0 Relevance: 3.1, APIs: 2, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,14DA7ED4), ref: 0047F211
RegCloseKey.ADVAPI32(00000000), ref: 0047F221

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction ID: 54b3090d3cf4edc9b1beeea5084ab922e7ff7cf66e968ba670c482e571a875e7
Opcode Fuzzy Hash: 53310d44514645ec7d69775a39ecbdcf721de23dfed265a4b960d742e8fdaebb
Instruction Fuzzy Hash: 1021F675E002199BDB10EF95DC81BEFB7B4EB48714F14827EE819B7382EB399D048694

Function 0049AD6F Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0049ADBB
GetFileType.KERNEL32(00000000), ref: 0049ADCD

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction ID: 9b806bec79c801feb13e2bd810877b0a9fec2b0519df56a68c4b4061daa9a1e0
Opcode Fuzzy Hash: 4f32fbaeb40bbd2ddea1473ad080d3a809991d13d49bec4850263f289b53d757
Instruction Fuzzy Hash: B611B7311047514ACF304A3E8C886677E96AB56331B39073FD4B687AF1C338D9A691CB

Function 0049F3BE Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000), ref: 0049F3FA
GetLastError.KERNEL32(00000000,?,0049F4F8,00000000,00000000,00000000,00000002,00000000,?,0049BE05,00000000,00000000,00000000,00000002,00000000,00000000), ref: 0049F407

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction ID: e391caa542caa0dd86735aa216be2178a54a5bfb1c46ce41420e93566301b438
Opcode Fuzzy Hash: 80260035985e1c693c2aa0c1ce2b926f9b01d7339fcba6fc68b9113c9f56a2d4
Instruction Fuzzy Hash: 57012232614215AFCF058F69DC49D9E3F2AEF95324F24422AF811DB290E775EE41CB94

Function 0047E47D Relevance: 3.1, APIs: 2, Instructions: 51synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004473D0: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,14DA7ED4), ref: 0044741C
Part of subcall function 004473D0: Process32FirstW.KERNEL32(00000000,?), ref: 00447468

Part of subcall function 00445950: CredEnumerateA.ADVAPI32(00000000,00000000,?,?,14DA7ED4,00000000,?), ref: 004459B2

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseCreateCredEnumerateFirstHandleMutexProcess32ReleaseSnapshotToolhelp32recv
String ID:
API String ID: 420082584-0
Opcode ID: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction ID: 21d12501465ffecb104f3396b5f4d487cf58cbb0265569f00e2db2d4d6eee1e0
Opcode Fuzzy Hash: 43ab8f6d0282bbd386fa8db408f8dbade1bdb5759a0961783a362487319a2d08
Instruction Fuzzy Hash: D9114C71806548EAEB00FBF7950639DB7A0AF0431CF10C59FE90623182DF7D1A0596AF

Function 0047E4C8 Relevance: 3.0, APIs: 2, Instructions: 40synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00485350: recv.WS2_32(?,00002000,00000000), ref: 004854A4

ReleaseMutex.KERNEL32(00000000), ref: 0047E525
CloseHandle.KERNEL32(00000000), ref: 0047E52C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseHandleMutexReleaserecv
String ID:
API String ID: 2659716615-0
Opcode ID: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction ID: d8074609c4b6b56a118d8c4864159468ec2ce210cc92c7876c64f9fcb1cee0d4
Opcode Fuzzy Hash: 0316209b74f7a510048f6aca9fcb45fc03c3e98c7b54836586b8f6f774e638a0
Instruction Fuzzy Hash: CD017171806518DAE710FBE2D50679DB7A0AF0931CF50869FE90623282DF791A0187AE

Function 0049C0BD Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0D3
GetLastError.KERNEL32(?,?,004A4A11,?,00000000,?,?,004A4CB2,?,00000007,?,?,004A3378,?,?), ref: 0049C0DE

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction ID: 589170845ab709ad3b3b60fb6adb52998bb4654d1de7eee66c817f55301082a8
Opcode Fuzzy Hash: 2c7be629525b77807a060ce78cd6937da288636f168411113672e5418cb75576
Instruction Fuzzy Hash: 9BE08631500614A7CF222BA1EC0D7893F58DB40355F104036F60897160DF398940CB88

Function 0048FAB0 Relevance: 1.7, APIs: 1, Instructions: 205COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048FCEA

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction ID: 258a51d4530bdfdbcfb978a880514f411ab203130510da66870d02f2c2448e76
Opcode Fuzzy Hash: 54dc556bc546888474d3f19e34a31102f3849cfd2e1ddc240e0765d6926b334a
Instruction Fuzzy Hash: DB71F671A002088FCB24EF28C490B6E77A5BF15314F244A7FE865CB791D739EA49CB95

Function 0044AF90 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction ID: 5047db877c7d9ae38b531aa0dda64427d2377832e7d6361d0852b000475400c5
Opcode Fuzzy Hash: 9135f7d9b5d1880a46c4ac02def5f1366672d51aadf79d8842421bd6ac20231f
Instruction Fuzzy Hash: F45180B5A0060ADFDB18CF28D480999FBB4FF4A320B5082AAE819C7B51D735ED55CBD4

Function 0049E314 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction ID: 7d9f16a24b0820fe6bfe4efb506255557b861a5981f24711c09fdeca13a2084c
Opcode Fuzzy Hash: f4d1b25cda05e585bd14aeef0c776674eabbc591f49ad1024f01acac1088cae4
Instruction Fuzzy Hash: 8751C470A00104EFDF14CF5ACC85AAE7FA5AF99324F28816AE8095B352D379DE41CB95

Function 00458550 Relevance: 1.6, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004586AF

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction ID: 39eac46aceff4f274d7df031c3ad8bb7d561d247c585fc64f7f09dd83a036c2e
Opcode Fuzzy Hash: 9d0e38e8a100f06b44e5b2c958822f107f66b3500270d3682d1b991c4f050d55
Instruction Fuzzy Hash: E941A4B1E001159FDB04DFA8C841AAEBBB5EF48315F10422EE815F7386DB34AE09CB95

Function 004520F0 Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0045223D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction ID: 543f2dd5f5f38f41d79c3b3e326d175c20dbca08f8aec97f7e4552ad9d8ce088
Opcode Fuzzy Hash: 8aafa409fbbe6252fd8d16ac1cef4b76429e1a26ed72850fe408f5c857c7a805
Instruction Fuzzy Hash: E1411272E001149BCB05EF68CD806AFB7A5EF56311F1402AFFC15EB302D6789E158B99

Function 00451F90 Relevance: 1.6, APIs: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004520DE

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction ID: 53fc907bca80d66a09b4c03435f3e8acb878ccb904669eb33cf36a05cbe64725
Opcode Fuzzy Hash: a14de396b08b32659630435c90f611bc18073001c29953638865ceda2285425b
Instruction Fuzzy Hash: E7414272D001049BCB15AF68CD806AEBBA5AF4A305F1002ABED15EB342D7749E158BD9

Function 0048F890 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0048F9FA

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction ID: 91311e753e2fbbf9cdae31aef67f458025fa5287f257254b7d49e4ed808e7769
Opcode Fuzzy Hash: d2fccf6f5b3df297b65b13170b90e5c1872a490292f016b70dee3939b6e05f49
Instruction Fuzzy Hash: 4F41B3B2E005049FDB14EF68C985A6EBBA9EB49320F24473EE815D7385DB349D04CB95

Function 00451E50 Relevance: 1.6, APIs: 1, Instructions: 125COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00451F7F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction ID: dbfd0375bb16cbcb281b8a1501cab73851c3df864c0bb83deedb38d5f1c134ec
Opcode Fuzzy Hash: bceca21abfd596b49baddf9976fd8ae7e3bbe9a292c563c34926c129456dd860
Instruction Fuzzy Hash: 72312572A001049BCB14DF688881B9FBBA5AB59315B24426FEC15CB303DB34DE5987D9

Function 004516D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 004517DF

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction ID: 65e916faade23ef3c336758c75d3ad3b55c144e32e026a5ec30b5c92d10e86c8
Opcode Fuzzy Hash: 4beab17cec18f8408a3d260484db6fe46066ad92ba7b493454d35fe0c2aa28c2
Instruction Fuzzy Hash: BB316772E001105BCB18EE6D9880A6FB7E9EB88312B24427FEC15D7352DA38DD0987D9

Function 0044D7D0 Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044D8F9

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction ID: 6687ec20b77dec97c90771c2cbe71989815263d1b8fcacfb2e06f2ee49a1853a
Opcode Fuzzy Hash: 4a7e0aa971e9c18d460f3d63606fed0fdd4bc56cc13da704aad23d70c2080c39
Instruction Fuzzy Hash: C3310A71E002045BE714AE6DD880A7EB7A4EF55324F24477FF865C7382D67899408759

Function 0044BAD0 Relevance: 1.6, APIs: 1, Instructions: 87COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0044BBB3

Part of subcall function 00434F80: ___std_exception_copy.LIBVCRUNTIME ref: 00434FF1

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task___std_exception_copy
String ID:
API String ID: 1979911387-0
Opcode ID: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction ID: f8cf7cd3dcf405c094d14d4edd2427269fc308b55f739c6c677f8adad7f52d2f
Opcode Fuzzy Hash: 14553861a0e6d344c6703ce135879dfe8084568f0dbccc5b703b736294f01183
Instruction Fuzzy Hash: 902126B1E006059BE7149F25D48166AB7A4EF15324F20036FE8258BB91E739FE90C7D6

Function 004BB697 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004BB6D1

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction ID: 7232828ef0ab4ea1277fc9c55e8108ad49929c9e06a984f5114aae078e858d40
Opcode Fuzzy Hash: c0068bc3e55a3d1622d6bbbbb6d136ac2493d2630b2467d4896e3e7752e83962
Instruction Fuzzy Hash: B9113671A0010AAFCB05DF58E9819CF7BF4EF88304F00405AF808AB311D770D9118BA4

Function 00482930 Relevance: 1.5, APIs: 1, Instructions: 43networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000000), ref: 00482968

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction ID: 15365ef676efcd120e403479619ae1d38f6ec3fc5171ce29fb9a7f72e5811cf6
Opcode Fuzzy Hash: 2e230c4dbecb0c91bd7935fcc59657d459b7808623847299c78205d0fd7c7ba6
Instruction Fuzzy Hash: 93F0B472302115AB83109A5DAD4096BF7DEDBCA7B0B2003A7FC2CC33E0E9618C0153D4

Function 0049C6A4 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,0043FE48,00000001,?,00499445,00000001,00000364,00000001,00000006,000000FF,?,004AD408,0043FE4A,0043FE44,?), ref: 0049C6E5

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction ID: bf89d2d5fe5833ab0f4bff440cdb33f04d1e0b68cec02520bce29c64fa949510
Opcode Fuzzy Hash: 934b5854b3b2fba1ba84eb25d33e8f66ddb7b9c5617b0a1ffb822db2bfc3c07a
Instruction Fuzzy Hash: 82F0BE322852256BAF215B229D85B5B3F589B417E0F195037FC08EA290CE78EC008AEC

Function 004406AD Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?), ref: 004406F2

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction ID: a1ffe5c8ce5f1f1a4397a2b9345f76ae3c812c30bf0ac5870f9d4861cf5b4c4e
Opcode Fuzzy Hash: df8edaa59d5e1f82e8cad7747c6b34272b3092e2e70faf3eef711e3f2ee9bc11
Instruction Fuzzy Hash: 95015631A0625DDFEB20DFA4D988BAEBBB4EF14314F2040DAD909A7282C7346E04DF55

Function 0049D15A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,0043FE44,?,004AD408,0043FE4A,0043FE44,?,?,?,00434C2F,0043FE48,0043FE48), ref: 0049D18C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction ID: de2ad87b2feeaf860c8dfd974d012cc9eb33a1afe18dd843800594eb24cb3dbb
Opcode Fuzzy Hash: 7ee9b205990c537f360d36ea94f63206e53d45b0dbf15067b0b63116574bd50f
Instruction Fuzzy Hash: 08E0E533A0132166EF212BA6AD02B5B3E48CB513A0F190137EC18962C4CB28DC0082ED

Function 004A8D62 Relevance: 1.5, APIs: 1, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004A8D69

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction ID: f589969de9c028132caa70972cc51c37c6bf7195d426b38a2c2fae52dece88af
Opcode Fuzzy Hash: 3aba680758f6379cc1f0e69a772bc6cab6bd8c88bcc4b04971677c60b68784ff
Instruction Fuzzy Hash: 71E09A76C4020D9ADB40DFD5C486BEFB7BCAB14304F50406BA205E6181EB7857448BE5

Function 004BC233 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000000,?,004BC623,?,?,00000000,?,004BC623,?,0000000C), ref: 004BC250

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction ID: c65ff2ef24fd0563ec255788cd93a1d7270b85fbbbb51eec7110af243f851585
Opcode Fuzzy Hash: dd275b77e4c8549b8163696f0af87788398892aa77d507c51891a1137c56f0af
Instruction Fuzzy Hash: 05D06C3200010DBBDF028F84EC06FDA3BAAFB48714F018010BA1866020C732E821ABA4

Function 004B9AE2 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,00486DD6,?,?,?,14DA7ED4,?,?), ref: 004B9AEC

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction ID: f88b8e15ca571a688dc5d535dfb7cb0f1e1a76fd2fb5174ce8f8aecae7ce3306
Opcode Fuzzy Hash: 19af6f8f66515c3ad7801cfde8998948d5a7d817498514074e40bdf49eb42b08
Instruction Fuzzy Hash: 0EC09B7490610E97CF00E7E5D94D88E77FCA608204F4004A1D551E3140E770FD45C795

Non-executed Functions

Function 0048A0A0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 325nativelibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,NtDuplicateObject,14DA7ED4,?,?), ref: 0048A0F7
GetProcAddress.KERNEL32(00000000), ref: 0048A0FE
OpenProcess.KERNEL32(00000040,00000000,00000000), ref: 0048A12A
NtQuerySystemInformation.NTDLL ref: 0048A153
NtQuerySystemInformation.NTDLL ref: 0048A178
GetCurrentProcess.KERNEL32 ref: 0048A1FD
NtQueryObject.NTDLL ref: 0048A22B
GetFinalPathNameByHandleA.KERNEL32(00000000,00000000,00000104,00000000,00000104,?,00000104,00000000), ref: 0048A315
CloseHandle.KERNEL32(00000000), ref: 0048A3E6
CloseHandle.KERNEL32(00000000), ref: 0048A441

Strings

File, xrefs: 0048A25B
ntdll.dll, xrefs: 0048A0EB
NtDuplicateObject, xrefs: 0048A0E6

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Handle$Query$CloseInformationProcessSystem$AddressCurrentFinalModuleNameObjectOpenPathProc
String ID: File$NtDuplicateObject$ntdll.dll
API String ID: 2729825427-3955674919
Opcode ID: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction ID: 0800680efb81c18e2f896ca5fb1c4f1751909ec1a20682d0b449f1ef79601e33
Opcode Fuzzy Hash: 8320b73641bfe2fd6a36d39389df1be313783445bc61d84dd6fe8aca722285e2
Instruction Fuzzy Hash: C3C1DE71D00218AFEF10EFA4DC45BAEBBB5FF44704F14452AE801A7281E7B9AD45CB96

Function 00419770 Relevance: 19.9, Strings: 2, Instructions: 17397COMMON

Download Yara Rule

Strings

YD@, xrefs: 0042C513
>c8 , xrefs: 0042CFA0

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: >c8 $YD@
API String ID: 0-2642259206
Opcode ID: 9dcf1b6b055526eb8ca3ce4f11dbcb7f980ceb29aa0c624363f390bc07ec487a
Instruction ID: 09539a6074c3f18202d3a6a28530d7ff6b4f8ede69b731f3fb06677334c75715
Opcode Fuzzy Hash: 9dcf1b6b055526eb8ca3ce4f11dbcb7f980ceb29aa0c624363f390bc07ec487a
Instruction Fuzzy Hash: B0B4BCB4D0525E8FCB15CFA8D9916EEFBB1AF59304F204299E948B7311D7302A81CFA5

Function 0047D2F0 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 410COMMON

Download Yara Rule

APIs

Part of subcall function 004517F0: Concurrency::cancel_current_task.LIBCPMT ref: 004518C2

Part of subcall function 0044DCC0: std::ios_base::_Addstd.LIBCPMT ref: 0044DDEF

Part of subcall function 00436640: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0047D95A

Strings

0hC, xrefs: 0047D950
open, xrefs: 0047D7E5
runas, xrefs: 0047D7EA, 0047D82A, 0047D82B
.G, xrefs: 0047D646, 0047D6BC, 0047D8DD
.ps1, xrefs: 0047D365
.cmd, xrefs: 0047D385
.vbs, xrefs: 0047D3A5
.exe, xrefs: 0047D349, 0047D423
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;', xrefs: 0047D443

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::ios_base::_$Ios_base_dtor$AddstdConcurrency::cancel_current_task
String ID: .cmd$.exe$.ps1$.vbs$.G$0hC$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+=-&^%$#@!(){}[},.;'$open$runas
API String ID: 2154145882-3307477358
Opcode ID: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction ID: f5ba6b163c3a98fee3f853caf05b9595179ad2eb3f8f0c36a39513699dfd7300
Opcode Fuzzy Hash: 272a3eff05d2f0994a98a4670cb8ea359793a3df70236ba5e5f34b7e97b052ef
Instruction Fuzzy Hash: 6A122770D00268DFDB20DF64CD85BDEBBB4AF19304F1481EAE849A7282DB755A84CF95

Function 00408270 Relevance: 12.0, Strings: 2, Instructions: 9466COMMON

Download Yara Rule

Strings

:v*-, xrefs: 00412A86
&iK, xrefs: 00412C8D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: &iK$:v*-
API String ID: 0-925339778
Opcode ID: 6b47c74f841ad1849f2da8e01aa531820f855eb79643490a739ceb0f548cc6b8
Instruction ID: a5ef6df3ed742f4fc82cee9b264c17634f39eece1ce4240dfd370ecc90fa88ba
Opcode Fuzzy Hash: 6b47c74f841ad1849f2da8e01aa531820f855eb79643490a739ceb0f548cc6b8
Instruction Fuzzy Hash: 3F44BDB8D0525ECBCB15CFA8C991AEEBBB1BF49300F20429AD94977311D7341A85CFA5

Function 004A70A7 Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1473COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004A72BE

Strings

1#IND, xrefs: 004A71AC
1#INF, xrefs: 004A71DD
1#SNAN, xrefs: 004A71B3
1#QNAN, xrefs: 004A71BA

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 9bb7f0d4613073bb4100fe9d2ee9a21b6dd33393f0141ef8f2b167b3b51c02dc
Instruction ID: b32a4effb01217c3c1626ef3a6516b83a08c7bb55f85dd273b9c2c9ced56d987
Opcode Fuzzy Hash: 9bb7f0d4613073bb4100fe9d2ee9a21b6dd33393f0141ef8f2b167b3b51c02dc
Instruction Fuzzy Hash: 9ED21871E086288FDB75CE28CD407EAB7B5EB66315F1441EBD40DA7240EB78AE818F45

Function 00479130 Relevance: 9.4, Strings: 7, Instructions: 665COMMON

Download Yara Rule

Strings

build_name, xrefs: 00479B33
grabber_max_size, xrefs: 00479AA8
self_destruct, xrefs: 00479B6C
links, xrefs: 00479AFA
extensions, xrefs: 00479AC1
port, xrefs: 00479A8E
IG, xrefs: 0047913D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: IG$build_name$extensions$grabber_max_size$links$port$self_destruct
API String ID: 0-2908327215
Opcode ID: b5557c1040c02529518dcf018fa524abe9d8d6e196c925b98e71a1a8f624317e
Instruction ID: a22682addece9ab4aab630da547c02470b3c7154c591281f96a53a82de49a099
Opcode Fuzzy Hash: b5557c1040c02529518dcf018fa524abe9d8d6e196c925b98e71a1a8f624317e
Instruction Fuzzy Hash: 6E72DFB4D04358CFEB14CFA9DA90BEDBBB0BF59308F248199D449AB351EB305A85CB54

Function 0046B620 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 331COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B7DA
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B81E
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B924
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 0046B970

Strings

., xrefs: 0046B942

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ___std_fs_directory_iterator_advance@8
String ID: .
API String ID: 2610647541-248832578
Opcode ID: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction ID: 99e23c5b304899c8ab8714ce46d423df57297e0934c6bc539a0dfe6d7ec6f1b4
Opcode Fuzzy Hash: 2e775b534ccb48514fa1d19158a196e6f147d360d3fd40777325cb8899fa8bdc
Instruction Fuzzy Hash: 77C1BF75A016269FCB20DF18C8847AAB3B5FF44314F14829AD915D7390EB39AD85CFC6

Function 004A6109 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002), ref: 004A61A2
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002), ref: 004A61CB
GetACP.KERNEL32 ref: 004A61E0

Strings

OCP, xrefs: 004A615D
ACP, xrefs: 004A6127

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction ID: 02a1f9ff6d074017cf30d732e6d651dacf3b6180dce544ba7b26bbdffeda2481
Opcode Fuzzy Hash: 83dfd683b9c94d176d38183288480b868ca78ec3c44069a2c66a1e4373e54840
Instruction Fuzzy Hash: 14217731B00101A6DB348F54C901A9BBBA7EB76B54B5F8466E909D7302EB36DE41C358

Function 004A62E5 Relevance: 7.7, APIs: 5, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetUserDefaultLCID.KERNEL32 ref: 004A63ED
IsValidCodePage.KERNEL32(00000000), ref: 004A642B
IsValidLocale.KERNEL32(?,00000001), ref: 004A643E
GetLocaleInfoW.KERNEL32(?,00001001,?,00000040,?,?,00000055,00000000,?,?,00000055,00000000), ref: 004A6486
GetLocaleInfoW.KERNEL32(?,00001002,?,00000040), ref: 004A64A1

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Locale$ErrorInfoLastValid$CodeDefaultPageUser
String ID:
API String ID: 415426439-0
Opcode ID: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction ID: c25bf07a23f3a9ec008bfe0b344d9b34e57977eb2ee5f51d57588e3c0d66081e
Opcode Fuzzy Hash: 478fc60fa90a9ec9e197162e05efa7e840982a7b058c794a341e424fb9183a7c
Instruction Fuzzy Hash: B351C031A00205ABDF10DFA5CC41AAF77B8BF2A700F09446BF905EB2C0D778D9058B68

Function 0042D150 Relevance: 6.9, APIs: 1, Strings: 2, Instructions: 1683COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 0042E6CB

Strings

6b6=, xrefs: 0042E43B
!dYH, xrefs: 0042EC76

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID: !dYH$6b6=
API String ID: 118556049-155378937
Opcode ID: 016e682e6e92c56b7e5f52a4a6c50224f71debeb36c814b1b43eac77d68e84f3
Instruction ID: 3adec6fdbd1554a06cbe821abd73873d9aa74c181532ca023f18934c78765b13
Opcode Fuzzy Hash: 016e682e6e92c56b7e5f52a4a6c50224f71debeb36c814b1b43eac77d68e84f3
Instruction Fuzzy Hash: 6023CDB8D0525CCBDB25CFA8C990AEDBBB1BF59300F24429AD84977311E7742A86CF54

Function 00498574 Relevance: 6.1, APIs: 4, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0049859D
GetSystemInfo.KERNEL32(?,?,?,0000001C), ref: 004985B1
VirtualAlloc.KERNEL32(?,-00000001,00001000,00000004,?,?,?,0000001C), ref: 00498602
VirtualProtect.KERNEL32(?,-00000001,00000104,?,?,?,0000001C), ref: 00498617

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Virtual$AllocInfoProtectQuerySystem
String ID:
API String ID: 3562403962-0
Opcode ID: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction ID: 57c86550534b148c15952eeeaf39776b02a492ab104de77fe61266457f658886
Opcode Fuzzy Hash: 4e29c64980591c23c9d6474b97963c5f1eeeaad4aec7d0b9861b07a888b65890
Instruction Fuzzy Hash: 91217C72E00119ABCF20DFA9DD85AEFBBB8EF45754F05017AE905E7140EA349D04C794

Function 004AC6BF Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 004AC6CB
IsDebuggerPresent.KERNEL32 ref: 004AC797
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 004AC7B0
UnhandledExceptionFilter.KERNEL32(?), ref: 004AC7BA

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction ID: 70dc3419eb2b6db1900c7bd06373213fcab329736da06f39ceabfcfe7a7444e5
Opcode Fuzzy Hash: 1a5f2cb74b25642d18f707c0b6da8939d9b46288bf323feffe580c9d32bdbba1
Instruction Fuzzy Hash: E1314A75C012189BDF21DF61DC897CEBBB8BF18700F1041AAE40DAB250E7759A84CF48

Function 0043D4A0 Relevance: 6.0, APIs: 1, Strings: 2, Instructions: 725COMMON

Download Yara Rule

Strings

filename, xrefs: 0043E0E3
content, xrefs: 0043E150

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: content$filename
API String ID: 0-474635906
Opcode ID: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction ID: d087ffba84baf14db51f89a037efaf3a0efd4671473d6540ebf1f333b1c0f3d3
Opcode Fuzzy Hash: b66f7423e610c841824d5b72251d930196416b83facb86d1c8f8609f3cb58a8b
Instruction Fuzzy Hash: 5392EEB0C052AC9BDB66DF68D9857DDBBB4AF18308F1441DAE80CA7252EB741B84CF45

Function 004B824D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

GetLocaleInfoEx.KERNEL32(!x-sys-default-locale,20000001,00000000,00000002,?,?,00435B2A,?,?), ref: 004B8261
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000,?,?,00435B2A,?,?), ref: 004B8288

Strings

!x-sys-default-locale, xrefs: 004B825C

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FormatInfoLocaleMessage
String ID: !x-sys-default-locale
API String ID: 4235545615-2729719199
Opcode ID: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction ID: 4f66f40a8a4f046c7b0032d4e1a4b833dd41128cf422eed9181fa496fdef01a0
Opcode Fuzzy Hash: 84205eb8d4b061531bed3096fe064d3d6fd842fcad4d2f7a7c64ada32d2dc388
Instruction Fuzzy Hash: 1AF030B5511108FFEF089BD5DC0EEEB77ACEB09394F10416AB501D6150E6B0AE00D778

Function 004BA04D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004805F0: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,14DA7ED4,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480617
Part of subcall function 004805F0: GetLastError.KERNEL32(?,00000000,00000000,14DA7ED4,00000000,004BCF70,000000FF,?,?,00513FC8), ref: 00480621

IsDebuggerPresent.KERNEL32(?,?,?,00434B5D), ref: 004BA080
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00434B5D), ref: 004BA08F

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 004BA08A

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction ID: d36ccacf6001ae6edc25a42526d65594664b7a1234a3e60676ee06f56b9b42c5
Opcode Fuzzy Hash: c51739a2d2ef137336e9adc3b97a1d747fb81e18f3053d9a6155fde0035c1d30
Instruction Fuzzy Hash: 64E065701007018FD330AF3AD40C3467BE0AB14304F00882FD945C7750E7B9D4088B66

Function 00474190 Relevance: 3.9, Strings: 3, Instructions: 192COMMON

Download Yara Rule

Strings

invalid BOM; must be 0xEF 0xBB 0xBF if given, xrefs: 004741D1
null, xrefs: 0047432B
invalid literal, xrefs: 00474389

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: invalid BOM; must be 0xEF 0xBB 0xBF if given$invalid literal$null
API String ID: 0-704505451
Opcode ID: c2853c1b5150f4562c75b0c9af08e518547b875ff11f585f7cc727e4d436818e
Instruction ID: 900511fe56f482f81459f08a410c1a76c5e1d1655cedb158031f5ff095a229d0
Opcode Fuzzy Hash: c2853c1b5150f4562c75b0c9af08e518547b875ff11f585f7cc727e4d436818e
Instruction Fuzzy Hash: 315183307001089BCB24EF79A5527BDB3E4DB95314F00859FE80E8BBC2DF69AA5497D9

Function 004320A0 Relevance: 2.8, Strings: 1, Instructions: 1521COMMON

Download Yara Rule

Strings

mce, xrefs: 004337A7

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID: mce
API String ID: 0-4153875931
Opcode ID: a73292159e262abdb433d94eaae0cf6bfd02510e463947a96e78a37495f057a5
Instruction ID: f690702d9b6e5b1c8f3d94d1572842c367def53288e29523866870a81cfcc782
Opcode Fuzzy Hash: a73292159e262abdb433d94eaae0cf6bfd02510e463947a96e78a37495f057a5
Instruction Fuzzy Hash: 0603DCB8D0424A9FDB04CF98D591AEEBFB1FF59304F248119D945BB302D7312A89CBA5

Function 00407470 Relevance: 2.3, APIs: 1, Instructions: 833COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00407D8B

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: fe31969a8a19a14cbb2cc1aa8e38a226629513882e496fcef040987109d5691f
Instruction ID: 812474a2bd2a8ecf408f930e0567eb9d9337a7355d6dea629df30afde2b5ebb2
Opcode Fuzzy Hash: fe31969a8a19a14cbb2cc1aa8e38a226629513882e496fcef040987109d5691f
Instruction Fuzzy Hash: 7BA2D0B4D0429D8BDB15CFA8C9816EEBBB1FF58304F20819AD949BB345DB341A89CF54

Function 0047E580 Relevance: 1.9, APIs: 1, Instructions: 415COMMON

Download Yara Rule

APIs

Part of subcall function 00481970: GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,14DA7ED4), ref: 004819D8

ShellExecuteW.SHELL32(00000000,?,?,?,00000000,00000000), ref: 0047EC85

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ExecuteFileModuleNameShell
String ID:
API String ID: 1703432166-0
Opcode ID: 7424804a8784dfbdf273c5a717085f3b2be6b7ed6bb5d16cf0bfa5b6ce38600f
Instruction ID: 2a91a513cc0bd4868b0af53c92a7a879c8891e0eaa161494f23d7b10a733aea0
Opcode Fuzzy Hash: 7424804a8784dfbdf273c5a717085f3b2be6b7ed6bb5d16cf0bfa5b6ce38600f
Instruction Fuzzy Hash: 5032AEB4D0625CEBDB25CF98E981ADDBBB1FF48314F24419AE809A7341E7706A85CF44

Function 00462080 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00462407

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 998b97963232ca513792be5bccec286f05fd367684fe6908831998ecf4a6ed59
Instruction ID: ef4cf88e9a4fdd266e31e3aa05a67ef024deafe90fb21754261dea51a8be5403
Opcode Fuzzy Hash: 998b97963232ca513792be5bccec286f05fd367684fe6908831998ecf4a6ed59
Instruction Fuzzy Hash: 87D18A31D04A49DFCB05CFA8C9806ADFBF1BF59310F18865AD841EB341E7B4A985CB95

Function 00462410 Relevance: 1.8, APIs: 1, Instructions: 312COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00462797

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 77eb809091e37f4e40faa665b14a1fdc1f259fd5624333971882c80142aac5d8
Instruction ID: ac15f3507e96ea44d263738e0e8876a083df1079939a1e49c6866d189bdfc312
Opcode Fuzzy Hash: 77eb809091e37f4e40faa665b14a1fdc1f259fd5624333971882c80142aac5d8
Instruction Fuzzy Hash: 25D1AB31E0464ADFCB04CFA8C9806ADFBF0BF59310F18865AD841EB341E7B4A941CB95

Function 004A620F Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 004992A7: GetLastError.KERNEL32(00000000,?,004A2D01), ref: 004992AB
Part of subcall function 004992A7: SetLastError.KERNEL32(00000000,00000000,00000001,00000006,000000FF), ref: 0049934D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,004A5FA9,00000000,00000000,?), ref: 004A623B

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: 8b81b91eadfdb3b62c299d10167f1a9c9d1e1bff8d4bf303c7f3fb8fddf9b379
Instruction ID: 9487850153f17b5aff8b54b84101990ee62d9d6b8c11e223cf6e38bc87e8a6da
Opcode Fuzzy Hash: 8b81b91eadfdb3b62c299d10167f1a9c9d1e1bff8d4bf303c7f3fb8fddf9b379
Instruction Fuzzy Hash: 3C01DB33A10112ABDF286A658D06BBB7768DB51754F1A446FEC06A3680DA38ED41C698

Function 00468750 Relevance: .4, Instructions: 402COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 346dc23a3b721231884126440995aecd87b62a600a1fea4fb977c7ca1dd55190
Instruction ID: f8786dd4fa61ba6b8208f2a0da3dfae63e0824739066c1b4c5cfb23239ebdf74
Opcode Fuzzy Hash: 346dc23a3b721231884126440995aecd87b62a600a1fea4fb977c7ca1dd55190
Instruction Fuzzy Hash: A2F149B2E112198FDF08CF99D8915EEBBB2BFC8310B29826ED41667344DB346D05CB95

Function 004B6380 Relevance: .3, Instructions: 305COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a7fb0066ca0e63ce1a3140edfe9943461d3f2e4af0e2cb6d3b63da6b91ab0d1
Instruction ID: b44fcc7ce13d6765da29ef4693de0a604283395fac7cf3727fef9bca0c1881a8
Opcode Fuzzy Hash: 0a7fb0066ca0e63ce1a3140edfe9943461d3f2e4af0e2cb6d3b63da6b91ab0d1
Instruction Fuzzy Hash: 07E1A551C4CBD891E6274B3D88426E2F3F4BFF9219F15A706EEE422421FB3662C68751

Function 00461250 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0ba32d3d0f547d4e0c0c2ee68133de1f9df539ce713836f75fcdfe5a29b6232
Instruction ID: aec3b6c702971bbda01d5f983ffd6c32ec602d3d125e3ae181568633efd48618
Opcode Fuzzy Hash: f0ba32d3d0f547d4e0c0c2ee68133de1f9df539ce713836f75fcdfe5a29b6232
Instruction Fuzzy Hash: E5C17B71E04649DFCB04CFA8C880AACFBB1BF59310F18826EE856E7351E734A955CB95

Function 0045C4C0 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66c816971dc4f363f466b11f2f4d5d7ddc684e31de2e014f784be5717bcb0236
Instruction ID: df46be6a361dd8f15a6f1edf4f2d8fac6e56a2b7ec9f979b005a651a2e3504fb
Opcode Fuzzy Hash: 66c816971dc4f363f466b11f2f4d5d7ddc684e31de2e014f784be5717bcb0236
Instruction Fuzzy Hash: 1B715372E1061A9FCB14CFADC9805AEB7F1FB88314F15822AE816E7345E774E905CB94

Function 0044E020 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0044E070
std::_Lockit::_Lockit.LIBCPMT ref: 0044E092
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E0BA
std::_Facet_Register.LIBCPMT ref: 0044E1D0
std::_Lockit::~_Lockit.LIBCPMT ref: 0044E1FA

Strings

p]C, xrefs: 0044E15D
cC, xrefs: 0044E17E
`aC, xrefs: 0044E16A

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: cC$`aC$p]C
API String ID: 459529453-2177106863
Opcode ID: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction ID: 1ff138599dd9b712ad814e44402e9ca08be03e0a2a2e3ebe43d51928b08ed38c
Opcode Fuzzy Hash: a449d14724036c8b5d7dcc6e3f8f606a5f6c47b464cfe817b38abf7381c673d4
Instruction Fuzzy Hash: 99518BB0D00259DBEB10CF99C8457AEBBB4FB18314F24815ED811AB381DB79AA44CBA5

Function 00452250 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0045228D
std::_Lockit::_Lockit.LIBCPMT ref: 004522AF
std::_Lockit::~_Lockit.LIBCPMT ref: 004522D7
__Getcoll.LIBCPMT ref: 0045239F
std::_Facet_Register.LIBCPMT ref: 004523EB
std::_Lockit::~_Lockit.LIBCPMT ref: 00452415

Strings

p]C, xrefs: 00452378
`aC, xrefs: 00452385

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetcollRegister
String ID: `aC$p]C
API String ID: 1184649410-1363152631
Opcode ID: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction ID: 568a7e1164ae6cef3cf0599e82aad122ccc02b6897634e5ab4797aad8f19cd87
Opcode Fuzzy Hash: bcac19400a142c5d17f9bc7acd982912d16d1a9c65db466b0de63643df1b93e3
Instruction Fuzzy Hash: 49518B70800208DFDB01DF95C9457DEBBB4FF55318F24815ED805AB282DBB9AE49CBA9

Function 0047C6C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 128COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0047C6FD
std::_Lockit::_Lockit.LIBCPMT ref: 0047C71F
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C747
std::_Facet_Register.LIBCPMT ref: 0047C834
std::_Lockit::~_Lockit.LIBCPMT ref: 0047C85E

Strings

p]C, xrefs: 0047C7E1
`aC, xrefs: 0047C7EE

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID: `aC$p]C
API String ID: 459529453-1363152631
Opcode ID: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction ID: 399bbb442a0c6c40ac274560e971594f6ebfe9651e6100c107b7a0aaef0602e2
Opcode Fuzzy Hash: e866effaa90865aaaa30be5826de822518346297a390443dd29a39b403041da2
Instruction Fuzzy Hash: 2C517A71900249DFDB15CF99C580BEEBBB4EB15318F24805ED409AB381DB79AE09CF95

Function 0047D190 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(File Downloader,00000001,00000000,00000000,00000000), ref: 0047D22D
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,80000000,00000000), ref: 0047D256
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D27C
InternetReadFile.WININET(00000000,?,00001000,00000000), ref: 0047D2B2
InternetCloseHandle.WININET(00000000), ref: 0047D2B9
InternetCloseHandle.WININET(?), ref: 0047D2C5

Strings

File Downloader, xrefs: 0047D214

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandleOpenRead
String ID: File Downloader
API String ID: 4038090926-3631955488
Opcode ID: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction ID: 638e9360adee8abd238f5bb9f06079602c51a7af3a4d5d450420b7b82b1eb562
Opcode Fuzzy Hash: 811208fdf33a36e9be3e42b468326af56e319a1deb0617af28b90d4cff8a8570
Instruction Fuzzy Hash: 5B318370A01655ABD730CF55CC45BEAB7B8EF44700F1041AAF549E7290DBB8AE84DFA8

Function 004AD600 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004AD637
___except_validate_context_record.LIBVCRUNTIME ref: 004AD63F
_ValidateLocalCookies.LIBCMT ref: 004AD6C8
__IsNonwritableInCurrentImage.LIBCMT ref: 004AD6F3
_ValidateLocalCookies.LIBCMT ref: 004AD748

Strings

csm, xrefs: 004AD6DD

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction ID: fca86a332ffc7d642b39a5fdc798139505592cae81a3a9a41e25a428a24f43dc
Opcode Fuzzy Hash: 255d3a1bd88e468a9ea08ee1f7f85cdc8f29e10e22a0162dea8eb7e65443c785
Instruction Fuzzy Hash: 2741D834E002089BCF10DF69C880A9E7BB5BF66318F14815BE81A5B752D739EA01CF95

Function 00436640 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 72COMMON

Download Yara Rule

APIs

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004366E9

Part of subcall function 004AFA0C: RaiseException.KERNEL32(E06D7363,00000001,00000003,0043FE44,?,?,?,004B9080,0043FE44,00513AB0,?,0043FE44,?,?,0000000C,14DA7ED4), ref: 004AFA6C

Strings

0hC, xrefs: 004366E3
ios_base::badbit set, xrefs: 00436677, 004366A2
ios_base::eofbit set, xrefs: 00436686
(>Q, xrefs: 004366D9
ios_base::failbit set, xrefs: 00436681

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ExceptionIos_base_dtorRaisestd::ios_base::_
String ID: (>Q$0hC$ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 1903096808-798308736
Opcode ID: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction ID: 0e9c3b5a5aba75944b05d252eccadd5948fd44e578ec9c0118fa22ff265feac2
Opcode Fuzzy Hash: 0ed2678322210cc8cc3a07b91dadb1e30d188d3d66194e55af3b44069607d8cc
Instruction Fuzzy Hash: 4E1122B29046487BD710DB59DC02FAA7398EB09754F04862FFD58872C1EB3DA90487AA

Function 0049D57F Relevance: 9.3, APIs: 6, Instructions: 329COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction ID: c45b587b2b6024bbc8d631f61cfde13028adc071dc65d72902c8bf59655bd6a7
Opcode Fuzzy Hash: 8a850e4bd8366f6602f7f439948ddd996ec0ba155590deffeea4e3919eff859f
Instruction Fuzzy Hash: 64B13572D00255AFDF11DF64CC81BAA7FA5EF55310F1441BBE454AB382D2789D01C7A9

Function 004A2113 Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 370COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 004A21FD
__freea.LIBCMT ref: 004A228D
__freea.LIBCMT ref: 004A22A9

Strings

am/pm, xrefs: 004A230B
a/p, xrefs: 004A236F

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: 35938f08404c0012c28b8581547da92bcaa7faac22c368983132e0e6ea66d68e
Instruction ID: 1d0f90a389a6ddb01c6eee3cfed114d4cdbff39c5c4e16d1e763b1923b69fac5
Opcode Fuzzy Hash: 35938f08404c0012c28b8581547da92bcaa7faac22c368983132e0e6ea66d68e
Instruction Fuzzy Hash: 32C1BF35904212AADB298F6CCA947BB77B0FF2B300F14405BE905AB750D3BD9D42EB59

Function 004B82A1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,14DA7ED4,?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3), ref: 004B82C9
GetProcAddress.KERNEL32(00000000,GetTempPath2W), ref: 004B82D5
GetTempPathW.KERNEL32(?,?,004CEC14,000000FF,?,004B87C4,00000105,?,00000000,?,?,?,0047FCE3,?,00000105,?), ref: 004B82F5

Strings

kernel32.dll, xrefs: 004B82C4
GetTempPath2W, xrefs: 004B82CF

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: AddressHandleModulePathProcTemp
String ID: GetTempPath2W$kernel32.dll
API String ID: 775647363-1846531799
Opcode ID: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction ID: 490c9918516094a75be01d3e1b1e27de5ce3fa518d230e70400d3a931493a6c9
Opcode Fuzzy Hash: f1cf7476179f5a48e5f157bd4a6fca76b08ed530dfc52bf4d8c2badd71eabe8a
Instruction Fuzzy Hash: C2F03A36A44654EFCB159F54EC05F9A7BA8FB09B60F008127EC16937A0DB79A800CB98

Function 004B9258 Relevance: 7.5, APIs: 5, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 004B925F
std::_Lockit::_Lockit.LIBCPMT ref: 004B926A
std::_Lockit::~_Lockit.LIBCPMT ref: 004B92D8

Part of subcall function 004B93BB: std::locale::_Locimp::_Locimp.LIBCPMT ref: 004B93D3

std::locale::_Setgloballocale.LIBCPMT ref: 004B9285
_Yarn.LIBCPMT ref: 004B929B

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3LocimpLocimp::_Lockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 1088826258-0
Opcode ID: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction ID: d57bef6452a6d9f87b7c1f6c81a415e25ff1084f0ba862d3ffc406506ccaed08
Opcode Fuzzy Hash: 9529708b05f48a18c841b776fc683316fa11b0247fd455af3d56381143c4ee67
Instruction Fuzzy Hash: 2101BC75A002149BDB09EF21E881ABE3BA5BF95714B18400EE90157381CF78AE42DBE9

Function 0047F2C0 Relevance: 6.5, APIs: 4, Instructions: 457registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0051C570,00000000,00020019,00000000,?,?,?,14DA7ED4,?,0051C2A0), ref: 0047F4D0
RegQueryValueExA.ADVAPI32(00000000,0051C2A0,00000000,000F003F,?,00000400,?,?,?,14DA7ED4,?,0051C2A0), ref: 0047F506
RegCloseKey.ADVAPI32(00000000,?,?,?,14DA7ED4,?,0051C2A0), ref: 0047F5A4
SysFreeString.OLEAUT32 ref: 0047FA14

Part of subcall function 0047A610: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 0047A678
Part of subcall function 0047A610: LocalFree.KERNEL32(?,00000000), ref: 0047A70F

Part of subcall function 004870B0: RegOpenKeyExA.KERNEL32(80000001,0051C570,00000000,00020019,00000000,14DA7ED4,0051C570,0051C2A0), ref: 00487182
Part of subcall function 004870B0: RegQueryValueExA.KERNEL32(00000000,?,00000000,000F003F,?,00000400), ref: 004871B6

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FreeOpenQueryValue$CloseCryptDataLocalStringUnprotect
String ID:
API String ID: 2380017125-0
Opcode ID: 7e960be66b091ef9db7ed46c6c44e7fe4e219e6aac80b315f3a2b635f0fdeb0e
Instruction ID: 56cbdaf4eb2024de0fd4bd59dbcd72090a4e5b75bdf23aa4f75e7a392944198d
Opcode Fuzzy Hash: 7e960be66b091ef9db7ed46c6c44e7fe4e219e6aac80b315f3a2b635f0fdeb0e
Instruction Fuzzy Hash: 24122BF0E002689BDB24DF24CC5479DB7B5AF44318F1086EAD64DA7282DB346E88CF59

Function 0049B476 Relevance: 6.3, APIs: 4, Instructions: 333fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(14DA7ED4,00000000,00000000,00000000), ref: 0049B4D9

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0049B72B
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0049B771
GetLastError.KERNEL32 ref: 0049B814

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction ID: 17746d06032e39ca1db24970b21defb679d9c3d722e4804f7fdb3bafa319cb4d
Opcode Fuzzy Hash: aef57a059a08420b8d5dfae5096d35553b8056bffb0ce8bb8e63412c3f54050f
Instruction Fuzzy Hash: 15D17A75D002489FCF05CFE9E980AEDBBB5EF49314F18816AE425EB351D734A906CB94

Function 00478300 Relevance: 6.3, APIs: 4, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00477B00: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,14DA7ED4,?,?), ref: 00477B54
Part of subcall function 00477B00: Process32FirstW.KERNEL32(00000000,?), ref: 00477BB9
Part of subcall function 00477B00: CloseHandle.KERNEL32(00000000), ref: 00477E84

ImpersonateLoggedOnUser.ADVAPI32(00000000,14DA7ED4,?,00000000), ref: 00478391

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: CloseCreateFirstHandleImpersonateLoggedProcess32SnapshotToolhelp32User
String ID:
API String ID: 1507787261-0
Opcode ID: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction ID: e502c6a69380433c55fd31efa36561dbf437e01bd72b95285a5588c942f2c0dc
Opcode Fuzzy Hash: ebec02cd2df44e7bd4fb65aecaaffec3bb885a70c3ad5895e8640ffefb46c4a4
Instruction Fuzzy Hash: F5F17070C0428DDEEB15DBA4C8587DDBBB0AF15308F24819ED04977292DB785F88DBA6

Function 004A077A Relevance: 6.1, APIs: 4, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction ID: 6bad779769d7c9384c33fcc5b288381071ef860472916b423066c301ca7f7ee1
Opcode Fuzzy Hash: 00fa7b59af023eaaf071b224feea6c80f4edf5776798c8ca34953c892f2afd27
Instruction Fuzzy Hash: D141E675A00704AFDB24AF39CC41B6BBBA9EB99714F20452FF101DB781D77DA9418B88

Function 004AB379 Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 004AB381

Part of subcall function 004A1489: WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000000,?,-00000008,?,00000000,-00000008,-00000008,00000000,?,0049B05F,?,00000000,-00000008), ref: 004A14EA

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3B9
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004AB3D9

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 69a85f7ed18cd74047bb984129651c996d53830a83c410699db2c70aab7f3113
Instruction ID: 352b9fd8ff6adfd48aa864b65f723ba5a946c2f7c3dd1541d1c3166fed4ac287
Opcode Fuzzy Hash: 69a85f7ed18cd74047bb984129651c996d53830a83c410699db2c70aab7f3113
Instruction Fuzzy Hash: B21156B19015157E7A1167B65C8AD6F6A5CDE5A398B10403BF801D1203EB7D9D0245BA

Function 004B8430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000001,00000400,14DA7ED4,00000000,00000000,00000000,00000000,00000000,00000001,?,?,0044E5F3,?,?,00000000,00000000), ref: 004B844D
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,14DA7ED4,00000001), ref: 004B8459
WideCharToMultiByte.KERNEL32(00000001,00000000,14DA7ED4,00000000,00000000,00000000,00000000,00000000,?,?,0044E5F3,?,?,00000000,00000000,00000000), ref: 004B847F
GetLastError.KERNEL32(?,?,0044E5F3,?,?,00000000,00000000,00000000,14DA7ED4,00000001), ref: 004B848B

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ByteCharErrorLastMultiWide
String ID:
API String ID: 203985260-0
Opcode ID: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction ID: 6b90caf3a67b14ffb57c64759c70b961d31bb881305e702148557666a2de5e43
Opcode Fuzzy Hash: b17853a5fac4461212df69502fdb333749a3d57a63655a8d7d2491092ae6608b
Instruction Fuzzy Hash: FB01BF36601156BFCF224F95DC08E9F3F7AEBD9791F118029FA0556220DA31C922EBA5

Function 004A95E5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000), ref: 004A95FC
GetLastError.KERNEL32(?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000,?,0049BE42,?), ref: 004A9608

Part of subcall function 004A95CE: CloseHandle.KERNEL32(FFFFFFFE,004A9618,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000,00000000), ref: 004A95DE

___initconout.LIBCMT ref: 004A9618

Part of subcall function 004A9590: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004A95BF,004A6707,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A95A3

WriteConsoleW.KERNEL32(00000000,00000000,?,00000000,?,004A671A,00000000,00000001,0000000C,00000000,?,0049B868,00000000,00000000,00000000,00000000), ref: 004A962D

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction ID: 8abc0c58445a332f8c6052495b9482a66327941653e6e46fd38a52645a0d97bb
Opcode Fuzzy Hash: 798d55b3f7968c96ef430ebc1f18d2e2465c9867b2c7648d7be43d295ef59026
Instruction Fuzzy Hash: DCF01237441215BBCF521F91DC09ACE3F66EF19364F024426FA2C86120C6368D60DB94

Function 004B01F1 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?), ref: 004B0216

Strings

MOC, xrefs: 004B0228
RCC, xrefs: 004B0230

Memory Dump Source

Source File: 00000002.00000002.1863047664.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_gem1.jbxd

Yara matches

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction ID: 70788f387beb527cb8114cdc5e5f216b8ccff70d73c61da87df7ae4bd57bd2ae
Opcode Fuzzy Hash: f6a5424a3b0add0d67cdb7a4433499b834c2692f3a3c89efa9c8eec31821c917
Instruction Fuzzy Hash: EE415871900209AFCF16CF98CD85AEEBBB5FF48305F18809AFA0567211D3399950DB68

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gem1.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Meduza Stealer

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_gem1.exe_daf150691981ac57c1cc14cff3d12fbabf996950_5a516dd6_359ee541-9ebf-4f51-9769-73b089985af5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8C3.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD98F.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD9AF.tmp.xml

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
gem1.exe

Function 028B7F09 Relevance: 40.5, APIs: 10, Strings: 13, Instructions: 294
threadinjectionmemoryCOMMON

Function 028B8086 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82
threadinjectionmemoryCOMMON

Function 010927BB Relevance: 1.8, APIs: 1, Instructions: 250
memoryCOMMON

Function 01090668 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Function 00485F00 Relevance: 31.7, APIs: 21, Instructions: 205
windowCOMMON

Function 00488400 Relevance: 27.7, APIs: 5, Strings: 10, Instructions: 1461
COMMON

Function 0047E240 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 199
synchronizationCOMMON

Function 00446400 Relevance: 20.1, APIs: 8, Strings: 3, Instructions: 833
libraryloaderCOMMON

Function 00485840 Relevance: 16.1, APIs: 8, Strings: 1, Instructions: 364
networkfileCOMMON

Function 004B8545 Relevance: 15.2, APIs: 10, Instructions: 200
fileCOMMON

Function 0048CB50 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
COMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre