Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1562776
MD5:	d0038532ae6cec64be83bc19d0b8f695
SHA1:	17a23380f80068d15ebc014cb2b1748bb45fb5c1
SHA256:	b412dd132cb21a0d4d7bb622c6fe49f9e6c5c934201815d570db774ac80194f5
Tags:	exeuser-Bitsight
Infos:

Detection

Poverty Stealer

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Poverty Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for sample

Tries to harvest and steal browser information (history, passwords, etc)

Contains functionality to query CPU information (cpuid)

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected TCP or UDP traffic on non-standard ports

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

file.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\file.exe" MD5: D0038532AE6CEC64BE83BC19D0B8F695)

cleanup

Malware Configuration

Threatname: Poverty Stealer

{"C2 url": "85.244.212.106:2227"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1654543699.0000000000297000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
Process Memory Space: file.exe PID: 6664	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.290000.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security
0.0.file.exe.290000.0.unpack	JoeSecurity_PovertyStealer	Yara detected Poverty Stealer	Joe Security

Suricata Signatures

ET MALWARE LUMAR Stealer Exfiltration M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T01:15:06.727599+0100	2048736	1	A Network Trojan was detected	192.168.2.4	49730	185.244.212.106	2227	TCP

Code function: 0_2_00294C2D GetSystemMetrics,KiUserCallbackDispatcher,GetSystemMetrics,GetDC,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateDIBSection,SelectObject,BitBlt,DeleteObject,DeleteDC,ReleaseDC,

0_2_00294C2D

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Mutant created: \Sessions\1\BaseNamedObjects\085f229d-d27d-4fc1-9dc1-8958125ccbd9

Source: file.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 67%

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ntkrnlmp.pdb/ source: file.exe, 00000000.00000002.1781980686.000000000A191000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbUxi source: file.exe, 00000000.00000002.1846640773.000000000C7EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb&>G/- source: file.exe, 00000000.00000002.1894109859.000000000D74C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbW\|k source: file.exe, 00000000.00000002.1846640773.000000000C7EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb;t source: file.exe, 00000000.00000002.1806662952.000000000B0F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: file.exe, 00000000.00000002.1869520671.000000000CFB3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1817983693.000000000B842000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1831076867.000000000C091000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1869520671.000000000CFBF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1894109859.000000000D74C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762944379.0000000008ED8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb<.B1" source: file.exe, 00000000.00000002.1915819842.000000000DF59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb: source: file.exe, 00000000.00000002.1818937151.000000000B890000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb source: file.exe, 00000000.00000002.1773857010.0000000009A6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1818937151.000000000B884000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1869520671.000000000CFBF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb-4B source: file.exe, 00000000.00000002.1894109859.000000000D756000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb9z source: file.exe, 00000000.00000002.1773857010.0000000009A6C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb8 source: file.exe, 00000000.00000002.1795920728.000000000A910000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdbo source: file.exe, 00000000.00000002.1760644057.00000000007AF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb=x source: file.exe, 00000000.00000002.1806662952.000000000B0EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb) source: file.exe, 00000000.00000002.1795920728.000000000A917000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1781980686.000000000A191000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb* source: file.exe, 00000000.00000002.1831076867.000000000C091000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb. source: file.exe, 00000000.00000002.1763849049.000000000904D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbx, source: file.exe, 00000000.00000002.1806662952.000000000B0EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1763849049.000000000904D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1846640773.000000000C7EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1869520671.000000000CFB3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1817983693.000000000B842000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1773857010.0000000009A6C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1915819842.000000000DF59000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1767555678.0000000009406000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1831076867.000000000C091000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1795920728.000000000A910000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1894109859.000000000D74C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1762944379.0000000008ED8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1781980686.000000000A191000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb# source: file.exe, 00000000.00000002.1767555678.0000000009406000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1781980686.000000000A191000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdbP source: file.exe, 00000000.00000002.1831076867.000000000C09B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb>"L=$ source: file.exe, 00000000.00000002.1915819842.000000000DF59000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb"JP source: file.exe, 00000000.00000002.1915819842.000000000DF66000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb<@ source: file.exe, 00000000.00000002.1773857010.0000000009A6C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb+Do source: file.exe, 00000000.00000002.1846640773.000000000C7EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: ntkrnlmp.pdb" source: file.exe, 00000000.00000002.1795920728.000000000A917000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb<~ source: file.exe, 00000000.00000002.1806662952.000000000B0EE000.00000004.00000020.00020000.00000000.sdmp

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-2301

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00291000 FindFirstFileW,FindNextFileW,EnterCriticalSection,LeaveCriticalSection,	0_2_00291000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00294EB2 FindFirstFileW,EnterCriticalSection,LeaveCriticalSection,FindNextFileW,	0_2_00294EB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00291DC9 FindFirstFileW,FindNextFileW,	0_2_00291DC9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00294145 FindFirstFileW,FindNextFileW,	0_2_00294145
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00293F87 FindFirstFileW,FindNextFileW,	0_2_00293F87

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002920E1 GetCurrentHwProfileA,GetSystemInfo,GlobalMemoryStatusEx,EnumDisplayDevicesA,EnumDisplayDevicesA,

0_2_002920E1

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Adobe\AcroCef\DC\Acrobat\Cache\Network\Cookies	Jump to behavior

Source: file.exe, 00000000.00000002.1821824765.000000000BA5C000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00293595 EnterCriticalSection,GetProcessHeap,RtlAllocateHeap,LeaveCriticalSection,

0_2_00293595

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002920E1 cpuid

0_2_002920E1

Stealing of Sensitive Information

Yara detected Poverty Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.2.file.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1654543699.0000000000297000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality

Yara detected Poverty Stealer

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.2.file.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.file.exe.290000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1654543699.0000000000297000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6664, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 DLL Side-Loading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	1 Data from Local System	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	12 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	68%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.XPACK.Gen3
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
85.244.212.106:2227	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
85.244.212.106:2227	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://ac.ecosia.org/autocomplete?q=	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.212.106	unknown	Romania		9009	M247GB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1562776
Start date and time:	2024-11-26 01:14:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 14 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
185.244.212.106	file.exe	Get hash	malicious	Poverty Stealer	Browse
	j95Whg3AY1.exe	Get hash	malicious	Poverty Stealer	Browse
	F7fahhucBo.exe	Get hash	malicious	Poverty Stealer	Browse
	IxE6TjWjRM.exe	Get hash	malicious	Poverty Stealer	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
M247GB	file.exe	Get hash	malicious	Poverty Stealer	Browse	185.244.212.106
	file.exe	Get hash	malicious	NetSupport RAT	Browse	45.61.128.74
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	93.120.123.217
	file.exe	Get hash	malicious	NetSupport RAT	Browse	45.61.128.74
	loligang.ppc.elf	Get hash	malicious	Mirai	Browse	104.224.90.41
	comprobante.exe	Get hash	malicious	Remcos	Browse	176.10.80.43
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	95.174.64.138
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	95.174.66.19
	7jBzTH9FXQ.exe	Get hash	malicious	Unknown	Browse	193.29.107.181
	fACYdCvub8.exe	Get hash	malicious	Unknown	Browse	217.138.199.203

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4829991676504175
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	30'208 bytes
MD5:	d0038532ae6cec64be83bc19d0b8f695
SHA1:	17a23380f80068d15ebc014cb2b1748bb45fb5c1
SHA256:	b412dd132cb21a0d4d7bb622c6fe49f9e6c5c934201815d570db774ac80194f5
SHA512:	af269471f7093445fb05bc6d6d185f9e48d0666674a3de50c4217757d3fdf39b067668bf2ca37eac91d5cb203c3ce3d4d634661e470d84d12c80c332344503ea
SSDEEP:	384:piY/4mcwYPSNOjKjg11+rVlOxxtNP97kJkgQ8pwIIumVbgORBprjlJZpTJ3uPbHO:piWWjjKjrOFgwItmVsOlr1B+90B
TLSH:	C7D29EA5CDE0D0B3C0630571B39FFB5B5DFF2626022844C767B50C55899AA81EAAB3D3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........M...,}..,}..,}..q~..,}..T...,}..,\|..,}..qt..,}..q...,}.Rich.,}.........PE..L......f.................`...........".......p....@

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x402282
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x668CD4E5 [Tue Jul 9 06:12:53 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	f63e2b20da57bba52ad3b39011a8e8d2

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 00000364h
push esi
push edi
push 00000DA3h
push 004084D4h
call dword ptr [00407018h]
test eax, eax
jne 00007FA248D44487h
jmp 00007FA248D448ECh
push 00408046h
push 00000000h
push 00000000h
call dword ptr [0040701Ch]
mov dword ptr [ebp-30h], eax
cmp dword ptr [ebp-30h], 00000000h
je 00007FA248D448C9h
call dword ptr [00407024h]
cmp eax, 000000B7h
je 00007FA248D448B8h
push 00000065h
pop edx
lea ecx, dword ptr [ebp-28h]
call 00007FA248D45E06h
cmp dword ptr [ebp-24h], 00000000h
je 00007FA248D4487Ah
push 0000011Ch
xor edx, edx
lea ecx, dword ptr [ebp-00000164h]
call 00007FA248D4578Eh
pop ecx
mov dword ptr [ebp-00000164h], 0000011Ch
lea ecx, dword ptr [ebp-00000164h]
call 00007FA248D469E6h
test eax, eax
jl 00007FA248D44842h
push dword ptr [ebp-00000158h]
push dword ptr [ebp-0000015Ch]
push dword ptr [ebp-00000160h]
push 00407474h
push 00000000h
call 00007FA248D457B7h
add esp, 14h
sub esp, 0000011Ch
push 00000047h
pop ecx
lea esi, dword ptr [ebp-00000164h]
mov edi, esp

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729
[LNK] VS2015 UPD2 build 23918

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x76b0	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x9000	0x2fc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x75d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0xb0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5ecd	0x6000	39c5351867ca632d1851a77edb7027dc	False	0.6384684244791666	data	6.6047321266474475	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0xaf6	0xc00	adcc9fb56ce6bb8a5b9550b0cd8aa46e	False	0.4612630208333333	PGP symmetric key encrypted data - Plaintext or unencrypted data	4.887509921041914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x8000	0x510	0x200	931354d1114628f4e46dab76862a5fe5	False	0.24609375	data	1.8621385217302757	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x9000	0x2fc	0x400	a015961f72d73e04f569fe5162e49191	False	0.6982421875	data	5.466540815021208	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	WaitForMultipleObjects, GetUserDefaultUILanguage, InitializeCriticalSectionAndSpinCount, CreateMutexA, Sleep, GetLastError, CloseHandle, GetSystemInfo, CreateThread, DeleteCriticalSection, ExitProcess, GlobalMemoryStatusEx, HeapFree, GetModuleFileNameW, HeapReAlloc, IsDBCSLeadByte, HeapAlloc, GetProcessHeap, WideCharToMultiByte, GetCurrentProcess, VirtualAlloc, GetFileAttributesW, DuplicateHandle, GetModuleHandleA, OpenProcess, LoadLibraryA, GetProcAddress, IsWow64Process, LeaveCriticalSection, MultiByteToWideChar, EnterCriticalSection
USER32.dll	ReleaseDC, EnumDisplayDevicesA, GetKeyboardLayoutList, GetSystemMetrics
ADVAPI32.dll	GetCurrentHwProfileA
CRYPT32.dll	CryptProtectData
urlmon.dll	ObtainUserAgentString

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T01:15:06.727599+0100	2048736	ET MALWARE LUMAR Stealer Exfiltration M2	1	192.168.2.4	49730	185.244.212.106	2227	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 01:15:06.486646891 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.606667995 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.606759071 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.606841087 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.607167006 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.726785898 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727227926 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.727426052 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727475882 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.727488041 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727555037 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727581024 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727598906 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.727616072 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727678061 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.727711916 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727725983 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727739096 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.727773905 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.727790117 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.846617937 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.847125053 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.847222090 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.847353935 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.847619057 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.847632885 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.847673893 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.847697020 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.966907024 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.966929913 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.966943026 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:06.966958046 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.966980934 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:06.967036963 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.008934975 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.009001017 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.128987074 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.177002907 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.177059889 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.380980968 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.381036043 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.622283936 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.622472048 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.622541904 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.742660046 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.742690086 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.742716074 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.742732048 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.742789030 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.742801905 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.742858887 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.742883921 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.742887020 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.742911100 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.742939949 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.742961884 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743175030 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743218899 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743257046 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743294954 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743307114 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743338108 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743360043 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743390083 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743413925 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743437052 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743439913 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743489981 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743534088 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743558884 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743583918 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743618965 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743655920 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743709087 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743773937 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743830919 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743832111 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743866920 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.743899107 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743913889 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.743999004 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744036913 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744055033 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744096041 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744126081 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744179010 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744208097 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744255066 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744330883 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744374990 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744410038 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744436026 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744457006 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744488955 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744491100 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744543076 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744580984 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744627953 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744657993 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744682074 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744705915 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744760990 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744796038 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744838953 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744868040 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744924068 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.744942904 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.744987011 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.788995981 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.789052010 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.862799883 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.862858057 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.862904072 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.862953901 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.863008022 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.863076925 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.863089085 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.863121033 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.863136053 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.863178015 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.863339901 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.863388062 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.863496065 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.863554001 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864034891 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864105940 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864166021 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864180088 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864218950 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864219904 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864269018 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864284039 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864310026 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864413023 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864425898 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864439011 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864460945 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864464045 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864478111 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864487886 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864516973 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864521027 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864538908 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864562988 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864589930 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864603043 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864646912 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864686012 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864711046 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864736080 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864761114 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864768028 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864773989 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864814997 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864828110 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864861012 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864892006 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864912987 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864936113 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.864939928 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864963055 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.864984989 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865010023 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865081072 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865093946 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865108967 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865128994 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865156889 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865204096 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865216970 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865258932 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865298033 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865310907 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865323067 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865353107 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865356922 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865365982 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865379095 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865382910 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865391016 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865401983 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865436077 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865447998 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865510941 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865524054 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865535975 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865547895 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865561962 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865562916 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865576982 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865596056 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865597963 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865638018 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.865639925 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.865689039 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.909032106 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.909101963 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.982928038 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.982943058 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.982956886 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.982980013 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.982980967 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983022928 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983026028 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983035088 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983071089 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983103037 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983155012 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983186960 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983200073 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983215094 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983234882 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983274937 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983280897 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983288050 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983330965 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983341932 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983356953 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983369112 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983421087 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983480930 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983531952 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983560085 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983608961 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983633041 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983645916 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983679056 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983701944 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983777046 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983791113 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.983833075 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.983988047 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984038115 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984133959 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984147072 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984194040 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984205961 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984217882 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984268904 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984272003 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984325886 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984338045 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984370947 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984395981 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984395981 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984409094 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984452009 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984452963 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984467030 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984507084 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984523058 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984529972 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984571934 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984621048 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984633923 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984671116 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984678030 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984683990 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984697104 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984725952 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984752893 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984777927 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984797955 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984834909 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984859943 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984867096 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984895945 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984913111 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984945059 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.984956026 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.984983921 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985014915 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985044003 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985044956 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985069036 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985090017 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985126019 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985215902 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985229015 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985280037 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985301018 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985315084 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985346079 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985357046 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985368967 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985379934 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985416889 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985524893 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985538006 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985549927 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985563993 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985579014 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985601902 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985622883 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985629082 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985635996 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985670090 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985687017 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985698938 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985712051 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985754013 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985796928 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985810041 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985848904 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985898972 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985910892 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985925913 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985946894 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.985980988 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.985981941 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986026049 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986069918 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986083984 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986110926 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986129045 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986140013 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986154079 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986200094 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986253977 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986267090 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986279964 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986306906 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986315012 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986320972 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986335993 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986362934 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986372948 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986469984 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986484051 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986495972 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986514091 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986521006 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986522913 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986536026 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986545086 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986571074 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986572027 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986641884 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986645937 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986671925 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986696005 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986722946 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986763000 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986823082 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986826897 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986835957 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986882925 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986895084 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986906052 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986907005 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986929893 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986932993 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986944914 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.986970901 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.986999035 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987025023 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987040043 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987066031 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987068892 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987082958 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987106085 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987112045 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987128019 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987149000 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987189054 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987257957 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987271070 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987320900 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987325907 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987341881 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987370014 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987380028 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987430096 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987431049 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987443924 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987485886 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987500906 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987579107 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987592936 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987605095 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987617016 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987628937 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987631083 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987668037 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987668991 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987680912 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987693071 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987704992 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987718105 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987759113 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:07.987762928 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:07.987813950 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.029288054 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.029300928 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.029349089 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.029367924 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103162050 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103174925 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103230953 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103249073 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103285074 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103298903 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103311062 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103331089 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103338003 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103365898 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103368044 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103379011 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103389978 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103425026 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103432894 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103482962 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103496075 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103533983 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103545904 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103617907 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103631020 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103667021 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103672981 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103719950 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103799105 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103811979 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103822947 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103848934 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103851080 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103863001 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.103883982 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103899956 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.103907108 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104001999 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104015112 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104060888 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104063988 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104087114 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104110956 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104129076 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104192019 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104204893 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104257107 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104306936 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104320049 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104352951 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104363918 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104372025 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104428053 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104470015 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104482889 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104521990 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104526997 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104535103 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104547024 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104582071 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104594946 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104641914 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104654074 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104676008 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104701042 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104727030 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104737043 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104789019 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104804039 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104823112 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104873896 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104902029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104913950 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104926109 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.104960918 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104975939 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.104979038 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105029106 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105113029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105127096 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105139017 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105150938 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105160952 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105164051 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105189085 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105216980 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105241060 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105253935 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105266094 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105298042 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105309010 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105320930 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105329037 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105334044 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105349064 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105367899 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105391979 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105402946 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105422020 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105473042 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105473995 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105484962 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105523109 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105536938 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105544090 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105593920 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105667114 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105679989 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105715036 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105736017 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105750084 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105762959 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105804920 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105842113 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.105892897 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.105997086 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106013060 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106024981 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106057882 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.106070042 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106080055 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.106125116 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.106157064 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106245041 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106251001 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.106260061 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106271982 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106287003 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106295109 CET	49730	2227	192.168.2.4	185.244.212.106
Nov 26, 2024 01:15:08.106329918 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106344938 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106465101 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106477976 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106501102 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106513023 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106580973 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106594086 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106667042 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106683969 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106707096 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106719017 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106796980 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106812000 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106920004 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106933117 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106946945 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.106987000 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107048988 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107062101 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107105017 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107209921 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107223034 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107235909 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107280016 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107292891 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107352018 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107453108 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107465029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107476950 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107574940 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107587099 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107599020 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107642889 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107708931 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107721090 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107769966 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107789040 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107831955 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107844114 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107897997 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.107911110 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108038902 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108051062 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108141899 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108155012 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108269930 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108283043 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108325958 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108339071 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108443022 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108457088 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108505964 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108519077 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108575106 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108587980 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108642101 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108654976 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108714104 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108726978 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108795881 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108808994 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108901978 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108915091 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108975887 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.108988047 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109052896 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109065056 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109118938 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109177113 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109189987 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109292030 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109304905 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109317064 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109328985 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109406948 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109421015 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109435081 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109447002 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109471083 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109494925 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109507084 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109674931 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109688044 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109699965 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109711885 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109736919 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109750032 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109765053 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109787941 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109812021 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109853029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109980106 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.109992027 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110016108 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110028028 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110076904 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110133886 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110146999 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110196114 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110208988 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110220909 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110337973 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110352039 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110363007 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110375881 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110399008 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110411882 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110447884 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110461950 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110560894 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110573053 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110635996 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110660076 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110748053 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110759974 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110894918 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110908031 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110939980 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110951900 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.110965967 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111052036 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111064911 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111109972 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111123085 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111135960 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111207008 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111221075 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111232996 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111244917 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111293077 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111306906 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111336946 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111350060 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111375093 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111387014 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111448050 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111459970 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111524105 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111536026 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111592054 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111603975 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111618996 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111641884 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111690998 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111705065 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111757040 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111768961 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111830950 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111844063 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111891985 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.111903906 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.112008095 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.112020969 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.112059116 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.112071991 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.112123966 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.112137079 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.149328947 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.149342060 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.149389029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.149401903 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223366976 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223419905 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223500013 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223524094 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223633051 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223700047 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223822117 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223846912 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.223951101 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224080086 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224195957 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224275112 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224440098 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224452019 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224570990 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224582911 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224755049 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224766970 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224781990 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224834919 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.224968910 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225006104 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225065947 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225090981 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225236893 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225249052 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225301981 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225354910 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225382090 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225394011 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225512028 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225524902 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225596905 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225610018 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225655079 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225667953 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225785971 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225799084 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225893974 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225908041 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225960016 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.225987911 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226078987 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226177931 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226191044 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226202965 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226315022 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226326942 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226387024 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226438999 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226517916 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226531029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226641893 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226655960 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226690054 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226701975 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226850033 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226862907 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226876020 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.226937056 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227022886 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227035999 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227078915 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227123976 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227226019 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227238894 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227278948 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227370024 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227413893 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227427006 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227530003 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227543116 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227619886 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227632999 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227737904 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227751017 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227864981 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227878094 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227890015 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227937937 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.227962971 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228060961 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228085041 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228096962 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228142023 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228188038 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228293896 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228307009 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228322029 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228346109 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228493929 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228506088 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228521109 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228574038 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228631973 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228643894 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228718996 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228734016 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228789091 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228857040 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228921890 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.228935003 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229010105 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229022980 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229109049 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229132891 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229257107 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229269028 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229326963 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229340076 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229399920 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229412079 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229485989 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229573011 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229635000 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229648113 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229717016 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229779005 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229811907 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229835033 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229914904 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.229947090 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230079889 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230093002 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230171919 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230185032 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230214119 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230226040 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230340958 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230353117 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230523109 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230535030 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230546951 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230561972 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230642080 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.230654001 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.231297970 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.257842064 CET	2227	49730	185.244.212.106	192.168.2.4
Nov 26, 2024 01:15:08.257898092 CET	49730	2227	192.168.2.4	185.244.212.106

Target ID:	0
Start time:	19:14:55
Start date:	25/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x290000
File size:	30'208 bytes
MD5 hash:	D0038532AE6CEC64BE83BC19D0B8F695
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000000.1654543699.0000000000297000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_PovertyStealer, Description: Yara detected Poverty Stealer, Source: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	27.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.7%
Total number of Nodes:	384
Total number of Limit Nodes:	8

Executed Functions

Function 00294C2D Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 208
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029475F: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,0029489D), ref: 00294771
Part of subcall function 0029475F: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,0029489D), ref: 0029477E

KiUserCallbackDispatcher.NTDLL(0000004C), ref: 00294C9E
GetSystemMetrics.USER32(0000004D), ref: 00294CA5
GetDC.USER32(00000000), ref: 00294CE0
GetCurrentObject.GDI32(00000000,00000007), ref: 00294CF3
GetObjectW.GDI32(00000000,00000018,?), ref: 00294D0C
DeleteObject.GDI32(00000000), ref: 00294D3E
CreateCompatibleDC.GDI32(00000000), ref: 00294D9F
CreateDIBSection.GDI32(00000000,?,00000000,?,00000000,00000000), ref: 00294DC0
SelectObject.GDI32(00000000,00000000), ref: 00294DD2
BitBlt.GDI32(00000000,00000000,00000000,?,002924F5,00000000,?,?,00CC0020), ref: 00294DF7

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

Part of subcall function 00293E03: EnterCriticalSection.KERNEL32(002984D4,?,0000011C), ref: 00293E15

Part of subcall function 002935C3: GetProcessHeap.KERNEL32(00000000,00000000,002926DC), ref: 002935CA
Part of subcall function 002935C3: RtlFreeHeap.NTDLL(00000000), ref: 002935D1

DeleteObject.GDI32(00000000), ref: 00294E95
DeleteDC.GDI32(00000000), ref: 00294E9C
ReleaseDC.USER32(00000000,00000000), ref: 00294EA5

Strings

6, xrefs: 00294D84
(, xrefs: 00294D78
2, xrefs: 00294C55
er32, xrefs: 00294C65
U, xrefs: 00294C5E
gdi3, xrefs: 00294C49
- ScreenSize: {lWidth=%d, lHeight=%d}, xrefs: 00294D28

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: Object$HeapSection$CriticalDelete$CreateEnterProcess$AllocateCallbackCompatibleCurrentDispatcherFreeHandleLeaveLibraryLoadMetricsModuleReleaseSelectSystemUser
String ID: ($- ScreenSize: {lWidth=%d, lHeight=%d}$2$6$U$er32$gdi3
API String ID: 1387450592-1028866296
Opcode ID: 347b437fc6361b70ff8c69f3e3b20a09d2e58b81ecbdf621260e2425184b57df
Instruction ID: c95b1869a4fbdc88a8d07918b350129b8b36743e2d5c32d96fc19a042ff03ccf
Opcode Fuzzy Hash: 347b437fc6361b70ff8c69f3e3b20a09d2e58b81ecbdf621260e2425184b57df
Instruction Fuzzy Hash: 1E719D71E10209ABDF20EFA4DC46FEEBB79AF48700F14405AE605FB291DB709A15CB65

Function 00291000 Relevance: 21.7, APIs: 4, Strings: 8, Instructions: 700
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,?), ref: 002913D1

Part of subcall function 00294108: GetFileAttributesW.KERNELBASE(006E4398,00291035,006E4398,?), ref: 00294109

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

FindFirstFileW.KERNELBASE(00000000,?,006E4398,?), ref: 00291161

Part of subcall function 00293F87: FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00293FE8
Part of subcall function 00293F87: FindNextFileW.KERNEL32(0029179D,?), ref: 00294089

EnterCriticalSection.KERNEL32(002984D4), ref: 002916F5
LeaveCriticalSection.KERNEL32(002984D4), ref: 0029170E

Strings

%s%s, xrefs: 0029150B, 00291854, 002919EA, 00291A4F
7a?=, xrefs: 00291364
Discord/, xrefs: 002913AF
$Lr, xrefs: 00291281
%s\%s, xrefs: 002911A2
7a?=, xrefs: 00291730
Telegram, xrefs: 002916FB
%s\*, xrefs: 0029112A

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: File$CriticalFindSection$EnterFirstHeapLeaveNext$AllocateAttributesProcess
String ID: $Lr$%s%s$%s\%s$%s\*$7a?=$7a?=$Discord/$Telegram
API String ID: 1893179121-60960798
Opcode ID: dda93f640c8c261b617d9cef1633cabb71e396d3c31e29564b7247b26f5e0594
Instruction ID: 2beeb48ceb54d42ae2844e10ff0dfdbfa1e75ae17ffebecf58aebf53d73cd0da
Opcode Fuzzy Hash: dda93f640c8c261b617d9cef1633cabb71e396d3c31e29564b7247b26f5e0594
Instruction Fuzzy Hash: A8322661E302175ADF28EFA59C85BFDB3B4AF44300F15406AE805E7291EB708EB5CB95

Function 002920E1 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

GetCurrentHwProfileA.ADVAPI32(?), ref: 00292198
GetSystemInfo.KERNELBASE(?,?,0000011C), ref: 002921BF
GlobalMemoryStatusEx.KERNELBASE(?), ref: 002921F3
EnumDisplayDevicesA.USER32(00000000,00000002,?,00000001), ref: 00292275

Strings

- CPU: %s (%d cores), xrefs: 002921D1
@, xrefs: 002921EA
- VideoAdapter #%d: %s, xrefs: 00292241
- RAM: %d GB, xrefs: 0029220A
- HWID: %s, xrefs: 002921AC

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateCurrentDevicesDisplayEnterEnumGlobalInfoLeaveMemoryProcessProfileStatusSystem
String ID: - CPU: %s (%d cores)$- HWID: %s$- RAM: %d GB$- VideoAdapter #%d: %s$@
API String ID: 330852582-565344305
Opcode ID: 3cd18f4b180b5c9de1f6b704602c661e7d82b637a4077d6fbc727ae52992dc60
Instruction ID: 8ff1fd76f8f0e7982aeceae2a77f54fc294197ad381f1d8df147faa78ba919ba
Opcode Fuzzy Hash: 3cd18f4b180b5c9de1f6b704602c661e7d82b637a4077d6fbc727ae52992dc60
Instruction Fuzzy Hash: 7E41B471528301ABDB24DF24DC85FABB7E8EBC8714F10491DF94987242E7709968CBA2

Function 00294EB2 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,002984D4,?), ref: 00294F58
EnterCriticalSection.KERNEL32(002984D4), ref: 00295014

Part of subcall function 00294EB2: LeaveCriticalSection.KERNEL32(002984D4), ref: 00295031

FindNextFileW.KERNELBASE(?,?), ref: 00295200

Part of subcall function 00294108: GetFileAttributesW.KERNELBASE(006E4398,00291035,006E4398,?), ref: 00294109

Strings

%s\%s, xrefs: 00294F72
Telegram, xrefs: 0029501A
%s\*, xrefs: 00294F42

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: File$CriticalFindSection$AttributesEnterFirstLeaveNext
String ID: %s\%s$%s\*$Telegram
API String ID: 648860119-4994844
Opcode ID: 27956e56439976032d1d682ed24bdd643342673e7fa54af49f6a3ff983180158
Instruction ID: 00133dc1d760c96d516d684b996f35f03c96fd0f2d6120701715876c0af581de
Opcode Fuzzy Hash: 27956e56439976032d1d682ed24bdd643342673e7fa54af49f6a3ff983180158
Instruction Fuzzy Hash: A7A16521E24358A9EF10DBA0EC46BFE7375EF44710F10505EE908EB2A1FBB11E558B5A

Function 00291DC9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 139
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?), ref: 00291E10

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

FindNextFileW.KERNELBASE(00000000,?), ref: 00291F94

Strings

%s%s, xrefs: 00291F4E
%s\%s, xrefs: 00291E9B
%s\*, xrefs: 00291DF7

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CriticalFileFindHeapSection$AllocateEnterFirstLeaveNextProcess
String ID: %s%s$%s\%s$%s\*
API String ID: 3555643018-2064654797
Opcode ID: 8414e9fbebe7c6852dd6d4884d826ea23143273c2f7161775f032d037e59b056
Instruction ID: c3385893804a4515593ac7508fa8f960ce31bfec1fbf8c9c0fbcfc1f0b700ec3
Opcode Fuzzy Hash: 8414e9fbebe7c6852dd6d4884d826ea23143273c2f7161775f032d037e59b056
Instruction Fuzzy Hash: 0A41C5712283075BCF14EF25D855A2E73E8AF85700F04092EF985C72A1EF31DA748B96

Function 00291D21 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029475F: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,0029489D), ref: 00294771
Part of subcall function 0029475F: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,0029489D), ref: 0029477E

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?,00000000), ref: 00291D80
CryptProtectData.CRYPT32(?,?,00000000,00000000,00000000,00000000,?), ref: 00291DB6

Strings

Poverty is the parent of crime., xrefs: 00291D9F
CRYPT32.dll, xrefs: 00291D4F

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CryptData$HandleLibraryLoadModuleProtectUnprotect
String ID: CRYPT32.dll$Poverty is the parent of crime.
API String ID: 3642467563-1885057629
Opcode ID: 26627f8fb3a829380bcf430d676873d278b8e9cae3ab6cfdea70a1bb44856f2e
Instruction ID: c18e3d68933ce4eb84f2a1f59611087a1f61b591d58cd4d85836e6caaf8fc318
Opcode Fuzzy Hash: 26627f8fb3a829380bcf430d676873d278b8e9cae3ab6cfdea70a1bb44856f2e
Instruction Fuzzy Hash: 771117B6D0020DABDF10DF95C8859EEBBBCFB48310F10456AE955B3240E770AE59CAA0

Function 00293595 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID:
API String ID: 1367039788-0
Opcode ID: 42b3477e30a2a6248f3d35da2b1cc99f87fbe698105c5d6b3ee43b9e92b65d66
Instruction ID: c971c5437f3dc915ac7fb3a2f7613de68e046ebf466df0c0c7c72d0d1fa66d5f
Opcode Fuzzy Hash: 42b3477e30a2a6248f3d35da2b1cc99f87fbe698105c5d6b3ee43b9e92b65d66
Instruction Fuzzy Hash: 09D0C73362812067CB5017FABC0D9DBBF6CEF96661B090057F205C3160DAA44C1587A0

Function 00292282 Relevance: 38.8, APIs: 13, Strings: 9, Instructions: 304
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(002984D4,00000DA3), ref: 00292297
CreateMutexA.KERNELBASE(00000000,00000000,085f229d-d27d-4fc1-9dc1-8958125ccbd9), ref: 002922AF
GetLastError.KERNEL32 ref: 002922C2

Strings

@, xrefs: 002925DE
Chrome, xrefs: 002925F3
085f229d-d27d-4fc1-9dc1-8958125ccbd9, xrefs: 002922A6, 00292612
$, xrefs: 002925FD
$d.log, xrefs: 00292678
- UserAgent: %s, xrefs: 002925B3
kernel32, xrefs: 00292439
shell32, xrefs: 002923E5
- OperationSystem: %d:%d:%d, xrefs: 0029232A

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CountCreateCriticalErrorInitializeLastMutexSectionSpin
String ID: $$$d.log$- OperationSystem: %d:%d:%d$- UserAgent: %s$085f229d-d27d-4fc1-9dc1-8958125ccbd9$@$Chrome$kernel32$shell32
API String ID: 2005177960-2910755732
Opcode ID: d82e750464baf9fb3c19cf5a64adf59ca928c8ecfd83ed004a0a69582b2d0253
Instruction ID: 71d4dca998abd2786f5a2f1415680a02e068660e419cf2c627febbf7d51add6d
Opcode Fuzzy Hash: d82e750464baf9fb3c19cf5a64adf59ca928c8ecfd83ed004a0a69582b2d0253
Instruction Fuzzy Hash: 00C1E730A64245EEEF14EFA0EC0AFED7B75AF15301F04005AE601AA1E2DF754A68CF65

Function 002953F8 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 139
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0029475F: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,0029489D), ref: 00294771
Part of subcall function 0029475F: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,0029489D), ref: 0029477E

WSAStartup.WS2_32(00000202,?), ref: 002954E0
socket.WS2_32(?,00000001,00000000), ref: 0029550F
connect.WS2_32(000000FF,?,00000010), ref: 0029554E
send.WS2_32(000000FF,00000000,00000000), ref: 00295570
send.WS2_32(000000FF,000000FF,106,00000000), ref: 0029558C
closesocket.WS2_32(000000FF), ref: 002955BC

Strings

ws2_32.dll, xrefs: 00295473
106, xrefs: 0029557B, 0029557F
185.244.212.106, xrefs: 00295523

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: send$HandleLibraryLoadModuleStartupclosesocketconnectsocket
String ID: 106$185.244.212.106$ws2_32.dll
API String ID: 653765639-2093737415
Opcode ID: f9021a0fca2179b65bbb4b7032b4f82884f83558b289b2944363a9588972345a
Instruction ID: 457be1f1067e05ef56bef086cca17552c14fcb98909b73cac6a3b17fb7be9e7c
Opcode Fuzzy Hash: f9021a0fca2179b65bbb4b7032b4f82884f83558b289b2944363a9588972345a
Instruction Fuzzy Hash: 3C51B230D44289EEEF028BE8D8097EDBFB99F15314F544089E660BE2C2C7B5475ACB65

Function 002944F7 Relevance: 16.7, APIs: 8, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00294108: GetFileAttributesW.KERNELBASE(006E4398,00291035,006E4398,?), ref: 00294109

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

EnterCriticalSection.KERNEL32(002984D4), ref: 00294580
LeaveCriticalSection.KERNEL32(002984D4), ref: 002945CC
EnterCriticalSection.KERNEL32(002984D4), ref: 0029464F
LeaveCriticalSection.KERNEL32(002984D4), ref: 00294688
EnterCriticalSection.KERNEL32(002984D4), ref: 002946C5
LeaveCriticalSection.KERNEL32(002984D4), ref: 00294708
EnterCriticalSection.KERNEL32(002984D4), ref: 00294721
LeaveCriticalSection.KERNEL32(002984D4), ref: 0029474A

Part of subcall function 00294377: GetModuleHandleA.KERNEL32(ntdll,NtQuerySystemInformation,?,00000000,?,?,?,?,?,002945FF), ref: 00294390
Part of subcall function 00294377: GetProcAddress.KERNEL32(00000000), ref: 00294399
Part of subcall function 00294377: GetModuleHandleA.KERNEL32(ntdll,NtQueryObject,?,?,?,?,002945FF), ref: 002943AA
Part of subcall function 00294377: GetProcAddress.KERNEL32(00000000), ref: 002943AD
Part of subcall function 00294377: OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,?,?,002945FF), ref: 0029442F
Part of subcall function 00294377: GetCurrentProcess.KERNEL32(002945FF,00000000,00000000,00000002,?,?,?,?,002945FF), ref: 0029444B
Part of subcall function 00294377: DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,002945FF), ref: 0029445A
Part of subcall function 00294377: CloseHandle.KERNEL32(002945FF,?,?,?,?,002945FF), ref: 0029448A

Part of subcall function 002935C3: GetProcessHeap.KERNEL32(00000000,00000000,002926DC), ref: 002935CA
Part of subcall function 002935C3: RtlFreeHeap.NTDLL(00000000), ref: 002935D1

Strings

\??\%s, xrefs: 0029452F
@, xrefs: 00294566
\Network\Cookies, xrefs: 002945EC

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$HandleHeapProcess$AddressModuleProc$AllocateAttributesCloseCurrentDuplicateFileFreeOpen
String ID: @$\??\%s$\Network\Cookies
API String ID: 330363434-2791195959
Opcode ID: e2c14f9cf643887fbefbc4e547acd27954c0306d0ca8e72f562eae11c41443ea
Instruction ID: 8dcf0ab433d9c4a760b4ffe9ff04bafc1987b011a992ffc75bdf56088cd80b5e
Opcode Fuzzy Hash: e2c14f9cf643887fbefbc4e547acd27954c0306d0ca8e72f562eae11c41443ea
Instruction Fuzzy Hash: E0713971960209AFDF04EF90DC4AFEDBBB5EF09305F14805AFA01AA1D1EB715A55CB50

Function 002948D6 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 231
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00000020,00003000,00000040,0000011C,?,?,?,?,?,00292351), ref: 002948F7

Part of subcall function 0029475F: GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,0029489D), ref: 00294771
Part of subcall function 0029475F: LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,0029489D), ref: 0029477E

GetCurrentProcess.KERNEL32(Q#)), ref: 0029496B
IsWow64Process.KERNEL32(00000000), ref: 00294972

Strings

ntdl, xrefs: 00294914
l, xrefs: 00294917
Q#), xrefs: 00294964, 0029497A, 0029496A
ntdllQ#), xrefs: 00294985

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentHandleLibraryLoadModuleVirtualWow64
String ID: Q#)$l$ntdl$ntdllQ#)
API String ID: 1207166019-1855892816
Opcode ID: 65ab3fea5beba9b4c30a354e1f97fddda5673148acf2da99b5f523b59718a8e6
Instruction ID: 910a7615d587e069483cfb637d8b70120afae7977f6d8a1c9fb6865a397eef49
Opcode Fuzzy Hash: 65ab3fea5beba9b4c30a354e1f97fddda5673148acf2da99b5f523b59718a8e6
Instruction Fuzzy Hash: C181C2306352029AEF24AF10FC59FB933A8FF16714F24151BE7099B2E0DBF489968756

Function 0029475F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdl,0000011C,?,?,?,?,?,?,?,0029489D), ref: 00294771
LoadLibraryA.KERNELBASE(ntdl,?,?,?,?,?,?,?,0029489D), ref: 0029477E

Strings

ntdl, xrefs: 0029476C, 0029477D

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: ntdl
API String ID: 4133054770-3973061744
Opcode ID: edfb2aa947b0f649667c41ec8ba48abe31a2e077872c988f614891c45398252b
Instruction ID: 830990aa99d6d37b691ecde61cb279a31a1aae16cdce2399cf33370dc65bf3b5
Opcode Fuzzy Hash: edfb2aa947b0f649667c41ec8ba48abe31a2e077872c988f614891c45398252b
Instruction Fuzzy Hash: B131CB35E106169BCF24EFA9C890EBDB7B5FF89704F04029AD455A3341C734A962CBA0

Function 002935C3 Relevance: 3.0, APIs: 2, Instructions: 8
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00000000,002926DC), ref: 002935CA
RtlFreeHeap.NTDLL(00000000), ref: 002935D1

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: abefb197a93a05b7d2162b3935f99776a61fed261360daa8400d318a7af47726
Instruction ID: 49c3eb1fdc245e1b549121ca10443b02891b3520dbb02241bcd78e85f5deec68
Opcode Fuzzy Hash: abefb197a93a05b7d2162b3935f99776a61fed261360daa8400d318a7af47726
Instruction Fuzzy Hash: 57B0127063D1016BEE085FE1BD0DB3E3618AF08303F000099F306D1460DA6845108620

Function 00294108 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(006E4398,00291035,006E4398,?), ref: 00294109

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 93492eb1d3cb2a18235f8c95286b02c5b1522397992ade2021abc0467a2479ed
Instruction ID: 8c13f362465b88b8fab569f1490e4c160bf21da0089568d75b4a1a63e5f80815
Opcode Fuzzy Hash: 93492eb1d3cb2a18235f8c95286b02c5b1522397992ade2021abc0467a2479ed
Instruction Fuzzy Hash: 72A022380302208BCA2C03302F2E00E30000E0A2F03220B8EB033C80E0EA28C2800000

Non-executed Functions

Function 00293F87 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 111fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00294108: GetFileAttributesW.KERNELBASE(006E4398,00291035,006E4398,?), ref: 00294109

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 00293FE8
FindNextFileW.KERNEL32(0029179D,?), ref: 00294089

Strings

%s%s, xrefs: 002940D2
%s\%s, xrefs: 00294022
%s\*, xrefs: 00293FD2

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: File$CriticalFindHeapSection$AllocateAttributesEnterFirstLeaveNextProcess
String ID: %s%s$%s\%s$%s\*
API String ID: 674214967-2064654797
Opcode ID: 8ef089ac2d5f50e775144c8ce546eb9f3bad03131a9fdddc4671901219276860
Instruction ID: ef5f38df606f3e812ffafd342b20ce626589ee0551a8b4e842e4e76573b18be5
Opcode Fuzzy Hash: 8ef089ac2d5f50e775144c8ce546eb9f3bad03131a9fdddc4671901219276860
Instruction Fuzzy Hash: D131EE71A24229A7CF24FA608C4AEBE77799F84300F0401A9F90596291EB358F668A91

Function 00294145 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 00294198
FindNextFileW.KERNEL32(000000FF,?), ref: 002941E4

Part of subcall function 002935C3: GetProcessHeap.KERNEL32(00000000,00000000,002926DC), ref: 002935CA
Part of subcall function 002935C3: RtlFreeHeap.NTDLL(00000000), ref: 002935D1

Strings

%s\%s, xrefs: 002941F8
%s\*, xrefs: 00294182

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: FileFindHeap$FirstFreeNextProcess
String ID: %s\%s$%s\*
API String ID: 1689202581-2848263008
Opcode ID: 2cc2cb177b404313abb94cbd3c66eb80122f73d6423de0dd977c6082f5feb2ca
Instruction ID: b7befd48ec89ff3080f9d4fb61cbf9bb5f2fafe49b6d99bd4b9584750e40f630
Opcode Fuzzy Hash: 2cc2cb177b404313abb94cbd3c66eb80122f73d6423de0dd977c6082f5feb2ca
Instruction Fuzzy Hash: 9C31AB70B20215ABCF20FFA4C895EAD77B9EF49740F504179BD0987241EB749E668F90

Function 00294377 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll,NtQuerySystemInformation,?,00000000,?,?,?,?,?,002945FF), ref: 00294390
GetProcAddress.KERNEL32(00000000), ref: 00294399
GetModuleHandleA.KERNEL32(ntdll,NtQueryObject,?,?,?,?,002945FF), ref: 002943AA
GetProcAddress.KERNEL32(00000000), ref: 002943AD

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

OpenProcess.KERNEL32(00000040,00000000,00000000,?,?,?,?,002945FF), ref: 0029442F
GetCurrentProcess.KERNEL32(002945FF,00000000,00000000,00000002,?,?,?,?,002945FF), ref: 0029444B
DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,002945FF), ref: 0029445A
CloseHandle.KERNEL32(002945FF,?,?,?,?,002945FF), ref: 0029448A
GetCurrentProcess.KERNEL32(002945FF,00000000,00000000,00000001,?,?,?,?,002945FF), ref: 00294498
DuplicateHandle.KERNEL32(?,?,00000000,?,?,?,?,002945FF), ref: 002944A7
CloseHandle.KERNEL32(?,?,?,?,?,002945FF), ref: 002944BA
CloseHandle.KERNEL32(000000FF), ref: 002944DD
CloseHandle.KERNEL32(?), ref: 002944E5

Strings

NtQueryObject, xrefs: 0029439B
NtQuerySystemInformation, xrefs: 00294386
ntdll, xrefs: 0029438B, 002943A2

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: Handle$CloseProcess$AddressCriticalCurrentDuplicateHeapModuleProcSection$AllocateEnterLeaveOpen
String ID: NtQueryObject$NtQuerySystemInformation$ntdll
API String ID: 3110323036-2044536123
Opcode ID: e2978d04a0661490b88823b835dd2190b3b6d441af815fae1ce1e9de8c1c84c5
Instruction ID: 1f2a51e7e8564ed5fdbb54de257af5418dd8557745ce9d0685367ecb47183f52
Opcode Fuzzy Hash: e2978d04a0661490b88823b835dd2190b3b6d441af815fae1ce1e9de8c1c84c5
Instruction Fuzzy Hash: 2E417071A2011AABDF10AFE59C49EAFBBB9EF44310F154165F905E2190DB70DE61CBA0

Function 00292A1E Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 245COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 00292B09

Strings

0123456789abcdef, xrefs: 00292A7E
0123456789ABCDEF, xrefs: 00292A85
(null), xrefs: 00292B9A
(null), xrefs: 00292C14

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: (null)$(null)$0123456789ABCDEF$0123456789abcdef
API String ID: 1302938615-1267642376
Opcode ID: 977a972568957437d1dbfd19ee4cf87cfd55ea494fea90e44586aef3218374cd
Instruction ID: 512c92dc9350e1dabce68585353d839d9524aa39e7c701a0c4d0f97cefa3b4b8
Opcode Fuzzy Hash: 977a972568957437d1dbfd19ee4cf87cfd55ea494fea90e44586aef3218374cd
Instruction Fuzzy Hash: 7091D271624703EFCF24CF28C89062ABBE5EF84344F25896EE49A87251D770EC98CB41

Function 00291FBA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 84COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32 ref: 0029201D
GetKeyboardLayoutList.USER32(00000032,?), ref: 0029207F

Strings

{%d} , xrefs: 002920B2
), xrefs: 002920CF
- SystemLayout %d, xrefs: 00292059
- KeyboardLayouts: ( , xrefs: 00292068

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: DefaultKeyboardLanguageLayoutListUser
String ID: )$- KeyboardLayouts: ( $- SystemLayout %d${%d}
API String ID: 167087913-619012376
Opcode ID: 706fdd82d74c7b7f4efee2cf1109650bb9021cfe5e19d64b05ee864c1399d864
Instruction ID: f666c02a01bceb8442418a5fedc55ffed1f1f625ba77a9da18da1dabfdb15ae2
Opcode Fuzzy Hash: 706fdd82d74c7b7f4efee2cf1109650bb9021cfe5e19d64b05ee864c1399d864
Instruction Fuzzy Hash: 5531BC50928288BADF009FE8A4027BDBB74EF24305F005096F548F6282D2794B69CB6A

Function 00293111 Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 410COMMON

Download Yara Rule

Strings

x, xrefs: 00293451

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID:
String ID: x
API String ID: 0-2363233923
Opcode ID: c0e546d354a0a82c12d02ff80e7722ed305953ac37e4c91d17623a84a70a1a98
Instruction ID: 06fedf613d1b0fa88ce4f92530ba40b945ce5e07b4e60806a65cdae5e45772ea
Opcode Fuzzy Hash: c0e546d354a0a82c12d02ff80e7722ed305953ac37e4c91d17623a84a70a1a98
Instruction Fuzzy Hash: BA028E74E2425AEFCF45CF98C985AADB7F4FB09304F108456E82AEB250D770AA61CF51

Function 00292C95 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 389COMMON

Download Yara Rule

APIs

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,00000005,00000000,00000000), ref: 00292ECA

Strings

6#), xrefs: 00292F4A

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: CriticalHeapSection$AllocateByteCharEnterLeaveMultiProcessWide
String ID: 6#)
API String ID: 1990697408-599568189
Opcode ID: 0734b9ebf656eb4c26d6fab82e568adf6006ece6f0752f20a7d2bdd274cee619
Instruction ID: 04c94da03858e3f5447fcf86d108f5c69380c15041807d24238b612aa33ac840
Opcode Fuzzy Hash: 0734b9ebf656eb4c26d6fab82e568adf6006ece6f0752f20a7d2bdd274cee619
Instruction Fuzzy Hash: 4E02A070A2424AEFCF05CF98D985AADBBF0FF09304F148455E865EB250D770AA65CF61

Function 00293DA9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,$d.log,000000FF,00000000,00000000,00000000,00000000,?,?,?,00293E4E,00000000,?,0000011C), ref: 00293DC1

Part of subcall function 00293595: EnterCriticalSection.KERNEL32(002984D4,?,?,00293C72,?,002922DE), ref: 0029359F
Part of subcall function 00293595: GetProcessHeap.KERNEL32(00000008,?,?,?,00293C72,?,002922DE), ref: 002935A8
Part of subcall function 00293595: RtlAllocateHeap.NTDLL(00000000,?,?,?,00293C72,?,002922DE), ref: 002935AF
Part of subcall function 00293595: LeaveCriticalSection.KERNEL32(002984D4,?,?,?,00293C72,?,002922DE), ref: 002935B8

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,$d.log,000000FF,00000000,?,00000000,00000000,?,00293E4E,00000000,?,0000011C), ref: 00293DF7

Strings

$d.log, xrefs: 00293DB8, 00293DF0

Memory Dump Source

Source File: 00000000.00000002.1759974814.0000000000291000.00000020.00000001.01000000.00000003.sdmp, Offset: 00290000, based on PE: true

Associated: 00000000.00000002.1759955556.0000000000290000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760028147.0000000000297000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760055328.0000000000298000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1760116878.0000000000299000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_290000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCriticalHeapMultiSectionWide$AllocateEnterLeaveProcess
String ID: $d.log
API String ID: 635875880-1910398676
Opcode ID: b2df967980b95a2278ffb5f9ee81e88ec9178983d08305f1a2c98094b194c0d8
Instruction ID: 92d793dedcabcff498c41607e503954208635c7c7d52b4a63e965ddd4dba193b
Opcode Fuzzy Hash: b2df967980b95a2278ffb5f9ee81e88ec9178983d08305f1a2c98094b194c0d8
Instruction Fuzzy Hash: 9AF082B16151217FA7249A6ADC1EC777BADDBC5B717054229FD19CF2D4D9209C0086B0

Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106
Source: unknown	TCP traffic detected without corresponding DNS query: 185.244.212.106

Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: file.exe, 00000000.00000002.1796832609.000000000AA57000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: file.exe, 00000000.00000002.1766312611.00000000092CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Poverty Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
file.exe

Function 00294C2D Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 208
windowCOMMON

Function 00291000 Relevance: 21.7, APIs: 4, Strings: 8, Instructions: 700
fileCOMMON

Function 002920E1 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 134
COMMON

Function 00294EB2 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 286
fileCOMMON

Function 00291DC9 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 139
fileCOMMON

Function 00291D21 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69
encryptionCOMMON

Function 00293595 Relevance: 6.0, APIs: 4, Instructions: 18
memoryCOMMON

Function 00292282 Relevance: 38.8, APIs: 13, Strings: 9, Instructions: 304
synchronizationCOMMON

Function 002953F8 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 139
networkCOMMON

Function 002944F7 Relevance: 16.7, APIs: 8, Strings: 3, Instructions: 179
COMMON

Function 002948D6 Relevance: 12.5, APIs: 3, Strings: 4, Instructions: 231
memoryCOMMON

Function 0029475F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94
libraryCOMMON

Function 002935C3 Relevance: 3.0, APIs: 2, Instructions: 8
memoryCOMMON

Function 00294108 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON